General
-
Target
TI.exe
-
Size
392KB
-
Sample
210511-69bwrh91xe
-
MD5
aecd8738094fcc9cdf76c8d538deda58
-
SHA1
84b0a144d7ff0c069f0e2f651b9e00e51ce9b559
-
SHA256
fa8bcb532dc59bca85334cee54152785e4f3ee8d7d9d6ca3680443beeb61ee58
-
SHA512
16745c8fee729f4480317b2c058552a20b085bc0934e67be6590cd26e41c479733d8a9442ce0e686b0ef9fa86d79db6bcc1349d274f021240d7dd4a3e08fadac
Static task
static1
Behavioral task
behavioral1
Sample
TI.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
TI.exe
Resource
win10v20210410
Malware Config
Extracted
Protocol: smtp- Host:
casids.co.ke - Port:
587 - Username:
webmaster@casids.co.ke - Password:
Eightis88
Targets
-
-
Target
TI.exe
-
Size
392KB
-
MD5
aecd8738094fcc9cdf76c8d538deda58
-
SHA1
84b0a144d7ff0c069f0e2f651b9e00e51ce9b559
-
SHA256
fa8bcb532dc59bca85334cee54152785e4f3ee8d7d9d6ca3680443beeb61ee58
-
SHA512
16745c8fee729f4480317b2c058552a20b085bc0934e67be6590cd26e41c479733d8a9442ce0e686b0ef9fa86d79db6bcc1349d274f021240d7dd4a3e08fadac
Score10/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-