General
-
Target
a6768194ebdd4c78978f19993eb4c685.exe
-
Size
1.4MB
-
Sample
211220-hxm4nahgg5
-
MD5
a6768194ebdd4c78978f19993eb4c685
-
SHA1
3c93ae4bf2b70f594db7b65bc0b12f3f4bd74352
-
SHA256
b754c85a785c0d550dcc9503323606c9460e7ad46aba30b6980b102fb9655452
-
SHA512
0897b075abd02cfa712513f27a0d3d801c6297b7bba847f58939c8ba94dae8cb346e7a5ab439c962244667510519f01880be5b90eb3873088b4d82b3bf333675
Static task
static1
Behavioral task
behavioral1
Sample
a6768194ebdd4c78978f19993eb4c685.exe
Resource
win7-en-20211208
Malware Config
Extracted
socelars
http://www.biohazardgraphics.com/
Targets
-
-
Target
a6768194ebdd4c78978f19993eb4c685.exe
-
Size
1.4MB
-
MD5
a6768194ebdd4c78978f19993eb4c685
-
SHA1
3c93ae4bf2b70f594db7b65bc0b12f3f4bd74352
-
SHA256
b754c85a785c0d550dcc9503323606c9460e7ad46aba30b6980b102fb9655452
-
SHA512
0897b075abd02cfa712513f27a0d3d801c6297b7bba847f58939c8ba94dae8cb346e7a5ab439c962244667510519f01880be5b90eb3873088b4d82b3bf333675
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-