General
-
Target
c2f2834b216ef788b6c0568d0267223c.exe
-
Size
713KB
-
Sample
210319-35bp99ff1n
-
MD5
c2f2834b216ef788b6c0568d0267223c
-
SHA1
77629d77891b0e995cbd577c7835d7465e5f8ff7
-
SHA256
b055016e0d82c57b58cd126f26b4b8f4dae1441f0019bdaa42452e815f128944
-
SHA512
7ccdb7dcb37a75b120655458eedfbf7057144d50c820e9acff72d018b613bee9a26263c4a1cd8b4d3a090c52ae66c7af0daa9bf4e39f5e3fc176f9f13b6b968a
Static task
static1
Behavioral task
behavioral1
Sample
c2f2834b216ef788b6c0568d0267223c.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
c2f2834b216ef788b6c0568d0267223c.exe
Resource
win10v20201028
Malware Config
Targets
-
-
Target
c2f2834b216ef788b6c0568d0267223c.exe
-
Size
713KB
-
MD5
c2f2834b216ef788b6c0568d0267223c
-
SHA1
77629d77891b0e995cbd577c7835d7465e5f8ff7
-
SHA256
b055016e0d82c57b58cd126f26b4b8f4dae1441f0019bdaa42452e815f128944
-
SHA512
7ccdb7dcb37a75b120655458eedfbf7057144d50c820e9acff72d018b613bee9a26263c4a1cd8b4d3a090c52ae66c7af0daa9bf4e39f5e3fc176f9f13b6b968a
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-