General
-
Target
SecuriteInfo.com.Trojan.DownLoader38.3828.25697.12964
-
Size
12.6MB
-
Sample
210321-tg77ptrpwe
-
MD5
897aabd3ac16050d62b8aacf85541454
-
SHA1
db2fd7fb1de3b602d7ba17da0d0b1ad4f6e552c9
-
SHA256
1d2ca907c73941dfcd91aa2ef0b96ecc137146be0dfd654e52f9408100f8fbbb
-
SHA512
10bc9fcb25e2991141fe279a7815c59f06b0213046f957b4637dcfd9c31473a7b7428db5844fe0f7a36c0320ca933f335d7edea5167d8960ad37e1f0860f200a
Malware Config
Targets
-
-
Target
SecuriteInfo.com.Trojan.DownLoader38.3828.25697.12964
-
Size
12.6MB
-
MD5
897aabd3ac16050d62b8aacf85541454
-
SHA1
db2fd7fb1de3b602d7ba17da0d0b1ad4f6e552c9
-
SHA256
1d2ca907c73941dfcd91aa2ef0b96ecc137146be0dfd654e52f9408100f8fbbb
-
SHA512
10bc9fcb25e2991141fe279a7815c59f06b0213046f957b4637dcfd9c31473a7b7428db5844fe0f7a36c0320ca933f335d7edea5167d8960ad37e1f0860f200a
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-