General
-
Target
Fast.exe
-
Size
55KB
-
Sample
200707-9ta8ak7gbn
-
MD5
4a3762d49120264f48deb29ca8668082
-
SHA1
4ed52a74441ed443c09d51b625d07cded9e2ba08
-
SHA256
b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
-
SHA512
dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39
Static task
static1
Behavioral task
behavioral1
Sample
Fast.exe
Resource
win7
Behavioral task
behavioral2
Sample
Fast.exe
Resource
win10v200430
Malware Config
Extracted
\??\c:\users\admin\desktop\info.txt
https://icq.com/windows/
https://icq.im/VIRTUALHORSE
Extracted
C:\Users\Admin\Desktop\info.hta
Targets
-
-
Target
Fast.exe
-
Size
55KB
-
MD5
4a3762d49120264f48deb29ca8668082
-
SHA1
4ed52a74441ed443c09d51b625d07cded9e2ba08
-
SHA256
b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
-
SHA512
dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes system backup catalog
Ransomware often tries to delete backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Modifies Windows Firewall
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application
-
Drops desktop.ini file(s)
-
Modifies service
-