Excel 4.0 Macro Utilized by TA505 to Target Financial

Excel 4.0 Macro Utilized by TA505 to Target Financial

IOC
Key String
aSDGsdgo445
asdgdgYss455

C2
vesecase.com
afsssdrfrm.pw
pointsoft.pw

Download URL
hxxp://office365advance.com/update
hxxp://office365homepod.com/genhost
hxxp://add3565office.com/rstr

Excel and eml samples
9c35e9aa9255aa2214d704668b039ef6
44dad70d844f6696fc148a7330df4b21
fee0b31cc956f083221cb6e80735fcc5
4c400910031ee3f12d9958d749fa54d5
2e0d13266b45024153396f002e882f15
26f09267d0ec0d339e70561a610fb1fd
09e4f724e73fccc1f659b8a46bfa7184
18c2adfc214c5b20baf483d09c1e1824
8cd3b60b167de2897aa6abf75b643d48
2cb8e5d871f5d6c1a8d88b1fb7372eb0
e9130a2551dd030e3c0d7bb48544aaea
9b0cc257a245f04bcd3766750335ad0c
9888d1109d6d52e971a3a3177773efaa
be021b903653aa4b2d4b99f3dbc986f0
2036a9e088d16e8ac35614946034b1a5
ef5741c4b96ef9498357dc4d33498163
e84f6742f566ccaa285c4f2b8d20a77c
Backdoor
53F7BE945D5755BB628DEECB71CDCBF2
5B7244C47104F169B0840440CDEDE788
E00499E21F9DCF77FC990400B8B3C2B5
272C036924BC9B8F44D6158220303A23
C6774C1417BE2E8B7D14BAD13911D04B
cc29adb5b78300b0f17e566ad461b2c7

Digital signature
Name: "VAL TRADEMARK TWO LIMITED"
Serial number:6e 91 95 0d d1 1f df 27 96 83 df b2 b4 9b 2f 47
Thumbprint:39 ca 0e 49 d4 01 77 4b 2b bf ea 16 27 60 7e 6e 6b dc 07 6f
Name: MASTER LIM LTD
Serial number:00 8e 3e 9a 2f e7 3c 91 98 5b 4f 90 d5 95 77 cd 6c
Thumbprint:26 0c 8d 47 00 3c a3 8a f0 54 53 f5 96 7a 8e 03 85 7f 04 88