General
-
Target
e1f063d6_by_Libranalysis
-
Size
142KB
-
Sample
210512-y1glnyls5e
-
MD5
e1f063d63a75e0e0e864052b1a50ab06
-
SHA1
75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7
-
SHA256
8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
-
SHA512
25681b210ee18bd60ba3fef496769283d51dc516569e1f1834d6d23a5927c1684b25ff67baf5fba66c908b364a13784f49facdde7a98b2fb8a8a41a2ec792ae3
Static task
static1
Behavioral task
behavioral1
Sample
e1f063d6_by_Libranalysis.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
e1f063d6_by_Libranalysis.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454
Targets
-
-
Target
e1f063d6_by_Libranalysis
-
Size
142KB
-
MD5
e1f063d63a75e0e0e864052b1a50ab06
-
SHA1
75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7
-
SHA256
8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
-
SHA512
25681b210ee18bd60ba3fef496769283d51dc516569e1f1834d6d23a5927c1684b25ff67baf5fba66c908b364a13784f49facdde7a98b2fb8a8a41a2ec792ae3
Score10/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Deletes itself
-
Drops startup file
-
Modifies WinLogon
-