General
-
Target
H00G4_Invoice_Copy.ISO
-
Size
1.2MB
-
Sample
211022-trmfqacgcl
-
MD5
7e63355feeeebf0787a0b0f0202d33ea
-
SHA1
c92f202fa7d4ac02c54b2b362a6365927c9e2b1c
-
SHA256
36416befe65a972ef1ad11eacdbb99314e6a288f98c58ea3ff6225d1fdbc46cf
-
SHA512
e25c3f2830d6f1228868075c15b3bac32342ff2299e69244168e1d0c7f1ddd0f5068444290a3accb1527f9eb3974284d4109eb540a4772839d4cbdf9b51b2ccf
Static task
static1
Behavioral task
behavioral1
Sample
H00G4_IN.JS
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
H00G4_IN.JS
Resource
win10-en-20211014
Malware Config
Extracted
vjw0rm
http://gg1592661.duckdns.org:7924
Targets
-
-
Target
H00G4_IN.JS
-
Size
10KB
-
MD5
b082682e872f7c1ba8efeebf629a4f3f
-
SHA1
aa013d976095c46964405e95ce022224c0a033ae
-
SHA256
a5d5de41b6546981f2284c07aa2fe17ac0b15727fb96fdff33db020a0826810e
-
SHA512
4329c35805fbfac63d683ec1ef69c039bde4fbe8d1951b8b79cf84cbf296556ee5d9e58e6ce77f81fd39cc05eec993775d015b760e77e9fe39d65767c2bb01a9
Score10/10-
Blocklisted process makes network request
-
Drops startup file
-
Adds Run key to start application
-