General
-
Target
usfive_20210718-162832
-
Size
472KB
-
Sample
210718-2acs1wgcca
-
MD5
91938ecb8df0cdc14dacfd947e451dfe
-
SHA1
14c44c7422b1086fb8be98601731577ff67b2909
-
SHA256
fa4452e8633985bc8a81893125afb876330b8e1f57613cc7d0ddb4a9d8f99dbb
-
SHA512
9497e5dea30c7480021e09741c67b70e32265a09d45f27aff9203bfc6803b383d1995e7a4699b5a18f9ade24b3579c6fc294f2a918b5b13d721f2b683cf38847
Static task
static1
Behavioral task
behavioral1
Sample
usfive_20210718-162832.exe
Resource
win7v20210408
Malware Config
Targets
-
-
Target
usfive_20210718-162832
-
Size
472KB
-
MD5
91938ecb8df0cdc14dacfd947e451dfe
-
SHA1
14c44c7422b1086fb8be98601731577ff67b2909
-
SHA256
fa4452e8633985bc8a81893125afb876330b8e1f57613cc7d0ddb4a9d8f99dbb
-
SHA512
9497e5dea30c7480021e09741c67b70e32265a09d45f27aff9203bfc6803b383d1995e7a4699b5a18f9ade24b3579c6fc294f2a918b5b13d721f2b683cf38847
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
DarkVNC Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-