General
-
Target
SecuriteInfo.com.Trojan.PackedNET.954.30622.21525
-
Size
582KB
-
Sample
210727-yjqc5blyls
-
MD5
f014241e8c93d4dbafb85339eae88015
-
SHA1
9c5599c4f75b03928576778ec87a55d56d3cefde
-
SHA256
b0cc2b05abaf593a784bb9d83cd0a61bf5b218605f61dba802df21c8ea54c7c6
-
SHA512
117e90944b92a26a019aca33c2666d6beaa6a92ec237dc487c5a037ac309eb38cb15bfa4f801795d1bbef05b99ec494945a4e86c6e21a11bbff1ebaa7c746fc2
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.954.30622.21525.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PackedNET.954.30622.21525.exe
Resource
win10v20210408
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
miratechs.gq - Port:
587 - Username:
arinzelog@miratechs.gq - Password:
7213575aceACE@#$
Targets
-
-
Target
SecuriteInfo.com.Trojan.PackedNET.954.30622.21525
-
Size
582KB
-
MD5
f014241e8c93d4dbafb85339eae88015
-
SHA1
9c5599c4f75b03928576778ec87a55d56d3cefde
-
SHA256
b0cc2b05abaf593a784bb9d83cd0a61bf5b218605f61dba802df21c8ea54c7c6
-
SHA512
117e90944b92a26a019aca33c2666d6beaa6a92ec237dc487c5a037ac309eb38cb15bfa4f801795d1bbef05b99ec494945a4e86c6e21a11bbff1ebaa7c746fc2
Score10/10-
CustAttr .NET packer
Detects CustAttr .NET packer in memory.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-