General
-
Target
b256d10ea8b49cb596fa1dd7b9007b7d03debb3ad05b79c0de45401a82910e7e
-
Size
130KB
-
Sample
211029-paa9xadcb2
-
MD5
f4f7a66d40a38fcc1236760b9b7b96e5
-
SHA1
4ad42999a173ece9885628263ca10d4cd0397e4f
-
SHA256
b256d10ea8b49cb596fa1dd7b9007b7d03debb3ad05b79c0de45401a82910e7e
-
SHA512
a4a603384debd1199d2dec6c9cd3e376727de96cb8af73778dc7bd2c0c9f3730f287c1c113001c9c3a2e456ba8229003e1bcdbdccb7a531ded5dcac46a0f3aba
Static task
static1
Behavioral task
behavioral1
Sample
b256d10ea8b49cb596fa1dd7b9007b7d03debb3ad05b79c0de45401a82910e7e.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
b256d10ea8b49cb596fa1dd7b9007b7d03debb3ad05b79c0de45401a82910e7e.exe
Resource
win10-en-20210920
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=ELUE74884A
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=ELUE74884A
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=ELUE74884A
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=ELUE74884A
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=ELUE74884A
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=ELUE74884A
Targets
-
-
Target
b256d10ea8b49cb596fa1dd7b9007b7d03debb3ad05b79c0de45401a82910e7e
-
Size
130KB
-
MD5
f4f7a66d40a38fcc1236760b9b7b96e5
-
SHA1
4ad42999a173ece9885628263ca10d4cd0397e4f
-
SHA256
b256d10ea8b49cb596fa1dd7b9007b7d03debb3ad05b79c0de45401a82910e7e
-
SHA512
a4a603384debd1199d2dec6c9cd3e376727de96cb8af73778dc7bd2c0c9f3730f287c1c113001c9c3a2e456ba8229003e1bcdbdccb7a531ded5dcac46a0f3aba
Score10/10-
Deletes itself
-
Drops startup file
-
Modifies WinLogon
-