General
-
Target
RunWW.exe
-
Size
577KB
-
Sample
210320-2akvjhes8x
-
MD5
013e637b83d9ae429d7eabc06644a913
-
SHA1
db89a5ea41fab24e0f54e192fd9d644b4c034d87
-
SHA256
1fa03c0a09833c2574dc0b65f1432eb1d66412f44b6a232894f0cb09d6ab6f74
-
SHA512
f8426656d95977e49d4bad70949ec750bd39d574104928e2e2f33a7f48818850f5bd380bbbfea3a4de793689a55116124154d6f79f014e3a2b8103e82c0c083e
Static task
static1
Behavioral task
behavioral1
Sample
RunWW.exe
Resource
win7v20201028
Malware Config
Targets
-
-
Target
RunWW.exe
-
Size
577KB
-
MD5
013e637b83d9ae429d7eabc06644a913
-
SHA1
db89a5ea41fab24e0f54e192fd9d644b4c034d87
-
SHA256
1fa03c0a09833c2574dc0b65f1432eb1d66412f44b6a232894f0cb09d6ab6f74
-
SHA512
f8426656d95977e49d4bad70949ec750bd39d574104928e2e2f33a7f48818850f5bd380bbbfea3a4de793689a55116124154d6f79f014e3a2b8103e82c0c083e
-
Deletes itself
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-