General
-
Target
triage_dropped_file
-
Size
470KB
-
Sample
210817-wf8cat3j3n
-
MD5
dee18056e6b4c47bd6dd796d993de94a
-
SHA1
a813777d59ddf9ea58803a70b8b1142df1d62f89
-
SHA256
221743da70a514a7edcbebd741f7f325d7f10f6cc576be93ba17ea0d4299b5a2
-
SHA512
d1f2c9404ee775a1dd9d0c1692d6d3e9c89d1a4fa01da8dc5c5d0ad74e8aff5f1a628b22a89b1dc61bb23c8edbc0144ae230e354c88c414bdac13c267ed44582
Static task
static1
Behavioral task
behavioral1
Sample
triage_dropped_file.dll
Resource
win7v20210410
Behavioral task
behavioral2
Sample
triage_dropped_file.dll
Resource
win10v20210408
Malware Config
Extracted
hancitor
1608_febd
http://patiennerrhe.com/8/forum.php
http://thougolograrly.ru/8/forum.php
http://chopprousite.ru/8/forum.php
Targets
-
-
Target
triage_dropped_file
-
Size
470KB
-
MD5
dee18056e6b4c47bd6dd796d993de94a
-
SHA1
a813777d59ddf9ea58803a70b8b1142df1d62f89
-
SHA256
221743da70a514a7edcbebd741f7f325d7f10f6cc576be93ba17ea0d4299b5a2
-
SHA512
d1f2c9404ee775a1dd9d0c1692d6d3e9c89d1a4fa01da8dc5c5d0ad74e8aff5f1a628b22a89b1dc61bb23c8edbc0144ae230e354c88c414bdac13c267ed44582
Score10/10-
Blocklisted process makes network request
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-