General
-
Target
E214.tmp.exe
-
Size
818KB
-
Sample
200512-f69yfgya3j
-
MD5
eb6c5d9f2aeed5e494370f4d28a0307b
-
SHA1
bf3d7db88f44c7440e81dd96b83b70038e88e3f5
-
SHA256
fafa82e7a61c1a516bb83c19d0e5ffce99eac17d34bb9280da34c515e1279653
-
SHA512
eb332247ee9006e7b64da251c929a40d38a0cab40e0b47e60c71f4ee0c3f24b887916aebc160f0dc954cf3a8a428c4c264068886155f6376d70481682e59c49d
Static task
static1
Behavioral task
behavioral1
Sample
E214.tmp.exe
Resource
win7v200430
Malware Config
Extracted
C:\_readme.txt
helpmanager@mail.ch
restoremanager@firemail.cc
https://we.tl/t-PHmSJZS9ey
Targets
-
-
Target
E214.tmp.exe
-
Size
818KB
-
MD5
eb6c5d9f2aeed5e494370f4d28a0307b
-
SHA1
bf3d7db88f44c7440e81dd96b83b70038e88e3f5
-
SHA256
fafa82e7a61c1a516bb83c19d0e5ffce99eac17d34bb9280da34c515e1279653
-
SHA512
eb332247ee9006e7b64da251c929a40d38a0cab40e0b47e60c71f4ee0c3f24b887916aebc160f0dc954cf3a8a428c4c264068886155f6376d70481682e59c49d
Score10/10-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application
-
Checks for installed software on the system
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-