General
-
Target
bonifico.exe
-
Size
931KB
-
Sample
200924-hnz7b7ms3e
-
MD5
920a84f8fce7b1b7bed3e1c7dfed6ace
-
SHA1
62ec70792894b003aa5ad208b576a2e182f0d3f0
-
SHA256
a36735377d731d16330587a190a99acbd5a1d9556e066d771268f8b4b6cd3821
-
SHA512
f2da84c7e5f0154d45b7db2077b3bc514d6bf5d9de41888ba0469ceeb545c01455730d45144e07daabeb789ee85ca7978a55ac18cd57cfc2771204b58bb5aed2
Static task
static1
Behavioral task
behavioral1
Sample
bonifico.exe
Resource
win7
Malware Config
Extracted
xpertrat
3.0.10
xbox
91.193.75.200:4726
79.134.225.97:4726
P4U8N5X3-N0E7-P7T5-M113-K7R6K4S0G6G6
Targets
-
-
Target
bonifico.exe
-
Size
931KB
-
MD5
920a84f8fce7b1b7bed3e1c7dfed6ace
-
SHA1
62ec70792894b003aa5ad208b576a2e182f0d3f0
-
SHA256
a36735377d731d16330587a190a99acbd5a1d9556e066d771268f8b4b6cd3821
-
SHA512
f2da84c7e5f0154d45b7db2077b3bc514d6bf5d9de41888ba0469ceeb545c01455730d45144e07daabeb789ee85ca7978a55ac18cd57cfc2771204b58bb5aed2
-
XpertRAT Core Payload
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Adds policy Run key to start application
-
Deletes itself
-
Adds Run key to start application
-
Program crash
-
Suspicious use of SetThreadContext
-