General
-
Target
967692708e762fda8ecb0b971aa06e33bca0b9d97b22ac7ffe8297df40a136dd
-
Size
13.0MB
-
Sample
201115-mr3kgfxpha
-
MD5
3c0f80a2feb1ba9cf781686c98dd6682
-
SHA1
d0960adb4d7be498b72089a880b94ed305b9d99c
-
SHA256
967692708e762fda8ecb0b971aa06e33bca0b9d97b22ac7ffe8297df40a136dd
-
SHA512
b8beac88f8722f818e302b70afecf68268f8811b56c127011ac7cfe86692ec5f937f20c97c60fb0b9f2691588be5069540faf65bdd4c57e648e33a67f643587c
Static task
static1
Behavioral task
behavioral1
Sample
967692708e762fda8ecb0b971aa06e33bca0b9d97b22ac7ffe8297df40a136dd.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
967692708e762fda8ecb0b971aa06e33bca0b9d97b22ac7ffe8297df40a136dd.exe
Resource
win10v20201028
Malware Config
Targets
-
-
Target
967692708e762fda8ecb0b971aa06e33bca0b9d97b22ac7ffe8297df40a136dd
-
Size
13.0MB
-
MD5
3c0f80a2feb1ba9cf781686c98dd6682
-
SHA1
d0960adb4d7be498b72089a880b94ed305b9d99c
-
SHA256
967692708e762fda8ecb0b971aa06e33bca0b9d97b22ac7ffe8297df40a136dd
-
SHA512
b8beac88f8722f818e302b70afecf68268f8811b56c127011ac7cfe86692ec5f937f20c97c60fb0b9f2691588be5069540faf65bdd4c57e648e33a67f643587c
Score10/10-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Modifies service
-
Suspicious use of SetThreadContext
-