General
-
Target
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2
-
Size
2.8MB
-
Sample
210329-vdnz2kc2z6
-
MD5
a282da0cf8b4a35a1fec2a5751682acf
-
SHA1
0d56c63f4afd00d7bd67fe561a2b7de0a08ff365
-
SHA256
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2
-
SHA512
c62e12270451702b4deeece6a33ef218e1d909d2c99946d45653428edfdae72f9ff20bd05bc2839fb0068abe9217ab469cc12fea748b00a7b666848003390743
Static task
static1
Behavioral task
behavioral1
Sample
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2.exe
Resource
win10v20201028
Malware Config
Targets
-
-
Target
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2
-
Size
2.8MB
-
MD5
a282da0cf8b4a35a1fec2a5751682acf
-
SHA1
0d56c63f4afd00d7bd67fe561a2b7de0a08ff365
-
SHA256
4a39b341e2d5fd5085d7ca2ee6a11d144a8dbc559d7e5c371947d9bfa98e87f2
-
SHA512
c62e12270451702b4deeece6a33ef218e1d909d2c99946d45653428edfdae72f9ff20bd05bc2839fb0068abe9217ab469cc12fea748b00a7b666848003390743
Score8/10-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-