General
-
Target
usfive_20210718-090922
-
Size
499KB
-
Sample
210718-1k2qyvg4tx
-
MD5
982f58d704d00ef6fa9a90d3fee6b98b
-
SHA1
810959da0fdbd7667a5356282b1e9bb2bdb21d72
-
SHA256
86b3b60d044d90b22c1285027ad44cc36b3c83ab2c4174fb92ef07cbe1d76cac
-
SHA512
0d19255e57b3eb47fa42c6b1fec153f5926b0043ae8ed939ef9df1d16bc145928d0ab824091bb39b5e597c6c8efcf41a0fa4cdc9870569889e7ea680b014e065
Static task
static1
Behavioral task
behavioral1
Sample
usfive_20210718-090922.exe
Resource
win7v20210410
Malware Config
Targets
-
-
Target
usfive_20210718-090922
-
Size
499KB
-
MD5
982f58d704d00ef6fa9a90d3fee6b98b
-
SHA1
810959da0fdbd7667a5356282b1e9bb2bdb21d72
-
SHA256
86b3b60d044d90b22c1285027ad44cc36b3c83ab2c4174fb92ef07cbe1d76cac
-
SHA512
0d19255e57b3eb47fa42c6b1fec153f5926b0043ae8ed939ef9df1d16bc145928d0ab824091bb39b5e597c6c8efcf41a0fa4cdc9870569889e7ea680b014e065
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
DarkVNC Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-