General
-
Target
NEW ORDER_78947533.EXE
-
Size
881KB
-
Sample
210810-h5b7z52nnn
-
MD5
7f05dc92a62ddd277baaeb55ebcfa407
-
SHA1
23c8c1a1a8d16180980f4b38a47832738f947141
-
SHA256
06c8a1e6544aede327bad32a5732d5bcfff143da73da01d34938efbe917e3289
-
SHA512
3cf46fbbf2e197b15fff65b3250f05add05537e534371ee50c8f0fe6524d4d32717d25ec79c60b8ebd1ed34b99d36522202834ac927fe3e1be5abb7c298768ef
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER_78947533.EXE
Resource
win7v20210410
Behavioral task
behavioral2
Sample
NEW ORDER_78947533.EXE
Resource
win10v20210408
Malware Config
Extracted
oski
kckark.xyz
Targets
-
-
Target
NEW ORDER_78947533.EXE
-
Size
881KB
-
MD5
7f05dc92a62ddd277baaeb55ebcfa407
-
SHA1
23c8c1a1a8d16180980f4b38a47832738f947141
-
SHA256
06c8a1e6544aede327bad32a5732d5bcfff143da73da01d34938efbe917e3289
-
SHA512
3cf46fbbf2e197b15fff65b3250f05add05537e534371ee50c8f0fe6524d4d32717d25ec79c60b8ebd1ed34b99d36522202834ac927fe3e1be5abb7c298768ef
Score10/10-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-