General
-
Target
sustenance.dll
-
Size
525KB
-
Sample
201109-e7t1r93kmn
-
MD5
d50829ab5499f6ec3a0829515db611d0
-
SHA1
d6d5ea77c50e01a1472e8ea7dbd1380df65fe0b4
-
SHA256
c194e82e8a3ada40421b28e668c9135f09f9336732dc31053fc0cebf7be97564
-
SHA512
104e1e5a50e0928d96cf28c560fbab1006e3cbd049edc661e8512eabee2cc80119e143359a14ff6d6e509c0cd2ea8ef64a137f6010e017a36293485d134a88b9
Static task
static1
Behavioral task
behavioral1
Sample
sustenance.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
sustenance.dll
Resource
win10v20201028
Malware Config
Extracted
zloader
CAN1
VBSDLL5
https://studentsclasses.com/post.php
https://booking-king.com/post.php
Targets
-
-
Target
sustenance.dll
-
Size
525KB
-
MD5
d50829ab5499f6ec3a0829515db611d0
-
SHA1
d6d5ea77c50e01a1472e8ea7dbd1380df65fe0b4
-
SHA256
c194e82e8a3ada40421b28e668c9135f09f9336732dc31053fc0cebf7be97564
-
SHA512
104e1e5a50e0928d96cf28c560fbab1006e3cbd049edc661e8512eabee2cc80119e143359a14ff6d6e509c0cd2ea8ef64a137f6010e017a36293485d134a88b9
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-