General
-
Target
5054cb2ac1c539765a1258dd0524756a8eccfee9b859c0bafed8c31d226687c2
-
Size
1.6MB
-
Sample
210302-2eqk7sb3hj
-
MD5
5f4709e48b024728452bb47f99422b89
-
SHA1
45f2e87a11fce7afd825a4b64edba77fb13f9331
-
SHA256
5054cb2ac1c539765a1258dd0524756a8eccfee9b859c0bafed8c31d226687c2
-
SHA512
6f9680745ecc230a7af9d5de5ed6a1225d3eddeca0f7b15da3ae3f4194d814617691373721a4af12018abc32f83877f6d0d912a1a958c6dadb96fd3b1cc5dad8
Static task
static1
Behavioral task
behavioral1
Sample
5054cb2ac1c539765a1258dd0524756a8eccfee9b859c0bafed8c31d226687c2.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
5054cb2ac1c539765a1258dd0524756a8eccfee9b859c0bafed8c31d226687c2.exe
Resource
win10v20201028
Malware Config
Targets
-
-
Target
5054cb2ac1c539765a1258dd0524756a8eccfee9b859c0bafed8c31d226687c2
-
Size
1.6MB
-
MD5
5f4709e48b024728452bb47f99422b89
-
SHA1
45f2e87a11fce7afd825a4b64edba77fb13f9331
-
SHA256
5054cb2ac1c539765a1258dd0524756a8eccfee9b859c0bafed8c31d226687c2
-
SHA512
6f9680745ecc230a7af9d5de5ed6a1225d3eddeca0f7b15da3ae3f4194d814617691373721a4af12018abc32f83877f6d0d912a1a958c6dadb96fd3b1cc5dad8
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-