General
-
Target
usfive_20210718-142250
-
Size
472KB
-
Sample
210718-kzncyldnxn
-
MD5
c3496df55defe6055694d5f6415bf9ee
-
SHA1
1d02dd7d82984ad2ae47cab8390059e3f5316649
-
SHA256
81d0fef5f97170c04985042d646bcf48d541852d047598791bc35c5187262917
-
SHA512
291152969a90da00d39016e57b64cce7c1a090db5560e3adc4b7faf233857e80d203d12116ecbf884c4b5aa1aab1cf1f64920683a6ecf7b66fa17257dd860714
Static task
static1
Behavioral task
behavioral1
Sample
usfive_20210718-142250.exe
Resource
win7v20210410
Malware Config
Targets
-
-
Target
usfive_20210718-142250
-
Size
472KB
-
MD5
c3496df55defe6055694d5f6415bf9ee
-
SHA1
1d02dd7d82984ad2ae47cab8390059e3f5316649
-
SHA256
81d0fef5f97170c04985042d646bcf48d541852d047598791bc35c5187262917
-
SHA512
291152969a90da00d39016e57b64cce7c1a090db5560e3adc4b7faf233857e80d203d12116ecbf884c4b5aa1aab1cf1f64920683a6ecf7b66fa17257dd860714
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
DarkVNC Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-