General
-
Target
b8a190a82389771c1862e35fde67018b
-
Size
344KB
-
Sample
200622-989r76nrke
-
MD5
b8a190a82389771c1862e35fde67018b
-
SHA1
fabf3ebc2cf571224e9aae55ecad911873a1a983
-
SHA256
14599971350afb71e8cb46c8bbb082c9e472db578b1ede02ecbc559d777bdfbb
-
SHA512
73d4c10b3c795f6d185bb96fc8a675089fcf7f0d39fb724cb3493e0da3915d25892862b52c8b3b52f3fbb244c7f7a69d4f5a1b5b042af99c72b6754eb51bc32e
Static task
static1
Behavioral task
behavioral1
Sample
b8a190a82389771c1862e35fde67018b.exe
Resource
win7
Behavioral task
behavioral2
Sample
b8a190a82389771c1862e35fde67018b.exe
Resource
win10
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-1131729243-447456001-3632642222-1000\{RecOveR}-ulcfw__.Txt
http://h3ds4.maconslab.com/E26FE11FAF29756F
http://aq3ef.goimocoa.at/E26FE11FAF29756F
http://fl43s.toabolt.at/E26FE11FAF29756F
http://xzjvzkgjxebzreap.onion/E26FE11FAF29756F
Extracted
C:\$Recycle.Bin\S-1-5-21-2066881839-3229799743-3576549721-1000\{RecOveR}-rihtp__.Txt
http://h3ds4.maconslab.com/33C566F0CC30CCF4
http://aq3ef.goimocoa.at/33C566F0CC30CCF4
http://fl43s.toabolt.at/33C566F0CC30CCF4
http://xzjvzkgjxebzreap.onion/33C566F0CC30CCF4
Targets
-
-
Target
b8a190a82389771c1862e35fde67018b
-
Size
344KB
-
MD5
b8a190a82389771c1862e35fde67018b
-
SHA1
fabf3ebc2cf571224e9aae55ecad911873a1a983
-
SHA256
14599971350afb71e8cb46c8bbb082c9e472db578b1ede02ecbc559d777bdfbb
-
SHA512
73d4c10b3c795f6d185bb96fc8a675089fcf7f0d39fb724cb3493e0da3915d25892862b52c8b3b52f3fbb244c7f7a69d4f5a1b5b042af99c72b6754eb51bc32e
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application
-
Program crash
-
Modifies service
-