General
-
Target
usfive_20210718-044029
-
Size
455KB
-
Sample
210718-wv4v942ayx
-
MD5
6acecf7a244dbbf26483578e4dc597d5
-
SHA1
f1a62a55910bd825459ad1fd9b8a4e64f2d7485f
-
SHA256
dbe884a85be7dce2d3db0efb74b9b3c39f5be64730dcce6f7c9e17acc6e444eb
-
SHA512
441aef1f9512ab94eeada971d48ec7a56aef061292f0b10880f36f2a8baa9166ff3ad2e4c13aa785d9f6799d694939432d742fd2e627435f021d000ded26c1fe
Static task
static1
Behavioral task
behavioral1
Sample
usfive_20210718-044029.exe
Resource
win7v20210410
Malware Config
Targets
-
-
Target
usfive_20210718-044029
-
Size
455KB
-
MD5
6acecf7a244dbbf26483578e4dc597d5
-
SHA1
f1a62a55910bd825459ad1fd9b8a4e64f2d7485f
-
SHA256
dbe884a85be7dce2d3db0efb74b9b3c39f5be64730dcce6f7c9e17acc6e444eb
-
SHA512
441aef1f9512ab94eeada971d48ec7a56aef061292f0b10880f36f2a8baa9166ff3ad2e4c13aa785d9f6799d694939432d742fd2e627435f021d000ded26c1fe
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
DarkVNC Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-