General
-
Target
VO3N8.cpl
-
Size
372KB
-
Sample
210121-5wjyz5ghe6
-
MD5
bb1272e0e3289985b4578f1b013fa5d5
-
SHA1
b19802976ff277fd4dd1adb5e950d84a3fcf6cf5
-
SHA256
c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2
-
SHA512
24cc60455a51a598482f6c1143e9027736dc4c82ca58aa8ae0e3c540006491d5b005284bf32167876ffaa60bedfa114cc59b07faa2b3e87b80b9f08713a18d42
Static task
static1
Behavioral task
behavioral1
Sample
VO3N8.cpl.dll
Resource
win7v20201028
Behavioral task
behavioral2
Sample
VO3N8.cpl.dll
Resource
win10v20201028
Malware Config
Extracted
zloader
kev
21/01
https://patatai.com/post.php
https://acquaie.com/post.php
https://noifatemmuce.tk/post.php
Targets
-
-
Target
VO3N8.cpl
-
Size
372KB
-
MD5
bb1272e0e3289985b4578f1b013fa5d5
-
SHA1
b19802976ff277fd4dd1adb5e950d84a3fcf6cf5
-
SHA256
c55a25514c0d860980e5f13b138ae846b36a783a0fdb52041e3a8c6a22c6f5e2
-
SHA512
24cc60455a51a598482f6c1143e9027736dc4c82ca58aa8ae0e3c540006491d5b005284bf32167876ffaa60bedfa114cc59b07faa2b3e87b80b9f08713a18d42
-
Blocklisted process makes network request
-
Suspicious use of SetThreadContext
-