General
-
Target
usfive_20210718-054407
-
Size
499KB
-
Sample
210718-y95bqp51hs
-
MD5
c7500b36c6478a2d5162e5e2a724f6b9
-
SHA1
519bb06a73c409183e760cf34c736814766aa26b
-
SHA256
51ea3dcb5378ab72e574655c231385a182feceec9d62b8e803b98e4b3499c3cb
-
SHA512
731c190caf7595b5c35a0870439fc90a0aca1ee90c9aa7e079157f2cc881ba342ca542c9a7e8354721136b15b809a9789c161879a8d121a9ba38e017806da035
Static task
static1
Behavioral task
behavioral1
Sample
usfive_20210718-054407.exe
Resource
win7v20210410
Malware Config
Targets
-
-
Target
usfive_20210718-054407
-
Size
499KB
-
MD5
c7500b36c6478a2d5162e5e2a724f6b9
-
SHA1
519bb06a73c409183e760cf34c736814766aa26b
-
SHA256
51ea3dcb5378ab72e574655c231385a182feceec9d62b8e803b98e4b3499c3cb
-
SHA512
731c190caf7595b5c35a0870439fc90a0aca1ee90c9aa7e079157f2cc881ba342ca542c9a7e8354721136b15b809a9789c161879a8d121a9ba38e017806da035
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
DarkVNC Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-