General
-
Target
8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.bin.sample.gz
-
Size
142KB
-
Sample
210517-wmjbrrz92x
-
MD5
af81e1a18c356279ccf300154a193926
-
SHA1
9724eee2a607e8a43834dd48df7f33467f00860e
-
SHA256
d10d3e09e1f93ccc06ccaa71c4b5e2bacaae2074024ffa7345362c01479ff5a8
-
SHA512
a86dfd57f8f9c90c55c08d92fcb7f9ea7c6ef4619debe2e52a55e0df554b68b5359798e5bf9ca9aabafd648a52b5f2a07eda627d76970d216894eb687e53e822
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454
http://prometheusdec.in/ticket.php?track=141-5D9-Y454
Targets
-
-
Target
sample
-
Size
142KB
-
MD5
e1f063d63a75e0e0e864052b1a50ab06
-
SHA1
75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7
-
SHA256
8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
-
SHA512
25681b210ee18bd60ba3fef496769283d51dc516569e1f1834d6d23a5927c1684b25ff67baf5fba66c908b364a13784f49facdde7a98b2fb8a8a41a2ec792ae3
Score10/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Modifies WinLogon
-