General
-
Target
52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
-
Size
254KB
-
Sample
210906-jdz5jsdhan
-
MD5
d70181d031e35f86d26be56d230b7d4e
-
SHA1
27ad13e49541f0f9806a21ea825aab95fba11608
-
SHA256
52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
-
SHA512
ad97d1a955f864751ac7243c54d3c611507f7c541aa4a9761ff7b587545a3aee0d23faa24ecd983f71458b9307197cf062181dd51503cc05a6a3f741162cfb2e
Static task
static1
Behavioral task
behavioral1
Sample
52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3.exe
Resource
win10-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
https://privatlab.com/file
http://sonarmsniko2lvfu.onion/?a=reg
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
https://privatlab.com/file
http://sonarmsniko2lvfu.onion/?a=reg
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
https://privatlab.com/file
http://sonarmsniko2lvfu.onion/?a=reg
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
https://privatlab.com/file
http://sonarmsniko2lvfu.onion/?a=reg
Targets
-
-
Target
52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
-
Size
254KB
-
MD5
d70181d031e35f86d26be56d230b7d4e
-
SHA1
27ad13e49541f0f9806a21ea825aab95fba11608
-
SHA256
52f7f9e8369a3e89899d40e89766c9642b137b25bfd58a2b564dac67a40445f3
-
SHA512
ad97d1a955f864751ac7243c54d3c611507f7c541aa4a9761ff7b587545a3aee0d23faa24ecd983f71458b9307197cf062181dd51503cc05a6a3f741162cfb2e
Score10/10-
Blocklisted process makes network request
-
Modifies Windows Firewall
-
Deletes itself
-
Drops startup file
-
Modifies file permissions
-
Modifies WinLogon
-