General
-
Target
183-60005400R revA.exe
-
Size
447KB
-
Sample
210726-rew2v4rq86
-
MD5
458ad2463c8a61f37ce0c256d5d824e0
-
SHA1
3d9e3331f558962d5fbbab68f8a9dcca0b31bb6f
-
SHA256
b1b4adb57471b463700ab48f81cd2550270fac73e0c1a95366fdc4380d15a659
-
SHA512
690cc999cf47d7d4020c3087c261b67a1468ed38392cf7b63ff41ed18a93d1a36a2f685c6f44c4121e61a2f49430ac019b7aff45a3a4a8a8da89339ce40b3a17
Static task
static1
Behavioral task
behavioral1
Sample
183-60005400R revA.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
183-60005400R revA.exe
Resource
win10v20210410
Malware Config
Extracted
oski
evakark.xyz
Targets
-
-
Target
183-60005400R revA.exe
-
Size
447KB
-
MD5
458ad2463c8a61f37ce0c256d5d824e0
-
SHA1
3d9e3331f558962d5fbbab68f8a9dcca0b31bb6f
-
SHA256
b1b4adb57471b463700ab48f81cd2550270fac73e0c1a95366fdc4380d15a659
-
SHA512
690cc999cf47d7d4020c3087c261b67a1468ed38392cf7b63ff41ed18a93d1a36a2f685c6f44c4121e61a2f49430ac019b7aff45a3a4a8a8da89339ce40b3a17
Score10/10-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-