General
-
Target
HOO8M_Invoice_Copy.iso
-
Size
72KB
-
Sample
211018-sgfpraegcq
-
MD5
a888145096f76ce437ab1028a7b9f7ae
-
SHA1
79349c085866ca9d813d248a429af1362464f547
-
SHA256
d7613ec37e645975b8269da83418168d8721b00a8b90bf7c15db6095ef25e1dd
-
SHA512
88f1d153e18a9d7eb3d06566d671d30bcc9e5d5fbba87d765c81e7c7d01420690f39b8c5e7d1f7d6474f5bd3fa55053930ec88a573fdceccdfb4123a347d94c5
Static task
static1
Behavioral task
behavioral1
Sample
HOO8M_Invoice_Copy.js
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
HOO8M_Invoice_Copy.js
Resource
win10-en-20211014
Malware Config
Extracted
vjw0rm
http://btime1624.duckdns.org:7923
Targets
-
-
Target
HOO8M_Invoice_Copy.js
-
Size
11KB
-
MD5
4bbeabc7d902f9f654cfe9c4f51d155d
-
SHA1
04b90a68e3911bc4edcf355c1db4567ae173c601
-
SHA256
e3f46470aa9ef52628f741e07db33a6af854693ae2a761d397bf87fbfbe687c9
-
SHA512
ecebe6eeb0848600cc8d4ac6b612ad4f02e5bce7d3f35ed14936508aa987c449a8e8029752bfa0b46ed68661836b99692abedce4175d3a7085aa22e0cb9882e5
Score10/10-
Blocklisted process makes network request
-
Drops startup file
-
Adds Run key to start application
-