General
-
Target
crypto.exe
-
Size
2.7MB
-
Sample
200923-q2m6xn1ew6
-
MD5
09af06e9c8666c02df5cb4f23191ad50
-
SHA1
656ce686290b5d9a40b62a79cdfe72015912a89c
-
SHA256
5531b27552a5a74235a72d91d42fbf5b643806a0c1ca01c32a8e74d87c6af732
-
SHA512
b5c0c8c2f20cff6fc50ef35f6637344fdeb8ef8d17c5d73b68acf0d4b8f1b66a7cd6044dfa97a9bfa4c23a9946ab9bb9fc7d1022e755a42ebb1e040d2b6de89b
Static task
static1
Behavioral task
behavioral1
Sample
crypto.exe
Resource
win7
Behavioral task
behavioral2
Sample
crypto.exe
Resource
win10v200722
Malware Config
Extracted
http://e-service.iag.bg/App_Themes/Efa/clear.txt
Extracted
http://e-service.iag.bg/App_Themes/Efa/video.mp4
Extracted
C:\Only_We_Can_Help_You.txt
https://t.me/Only_We_Can_Help_You
Extracted
C:\Users\Public\Desktop\Only_We_Can_Help_You.html
https://t.me/Only_We_Can_Help_You
Extracted
C:\Only_We_Can_Help_You.txt
https://t.me/Only_We_Can_Help_You
Targets
-
-
Target
crypto.exe
-
Size
2.7MB
-
MD5
09af06e9c8666c02df5cb4f23191ad50
-
SHA1
656ce686290b5d9a40b62a79cdfe72015912a89c
-
SHA256
5531b27552a5a74235a72d91d42fbf5b643806a0c1ca01c32a8e74d87c6af732
-
SHA512
b5c0c8c2f20cff6fc50ef35f6637344fdeb8ef8d17c5d73b68acf0d4b8f1b66a7cd6044dfa97a9bfa4c23a9946ab9bb9fc7d1022e755a42ebb1e040d2b6de89b
Score10/10-
Clears Windows event logs
-
Blacklisted process makes network request
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
JavaScript code in executable
-