General
-
Target
31f6b2929bd25668ffcfc8216af735a5.exe
-
Size
1.4MB
-
Sample
211231-g8c76agfc8
-
MD5
31f6b2929bd25668ffcfc8216af735a5
-
SHA1
f77aba621c36609549a97ed8f8592a501e040f76
-
SHA256
8ea9c5b6af17446b164b3aab8e52907d5c31b16c3e71690a40832a22a9fc8a2a
-
SHA512
057825daec09487f7ca784430d16247dd64b2ff018aadbe84164f4710403fb291319d26d4855a508b26fdb840327483931c24413ddd8ad060093fecec4ba8c64
Static task
static1
Behavioral task
behavioral1
Sample
31f6b2929bd25668ffcfc8216af735a5.exe
Resource
win7-en-20211208
Malware Config
Extracted
socelars
http://www.chosenncrowned.com/
Targets
-
-
Target
31f6b2929bd25668ffcfc8216af735a5.exe
-
Size
1.4MB
-
MD5
31f6b2929bd25668ffcfc8216af735a5
-
SHA1
f77aba621c36609549a97ed8f8592a501e040f76
-
SHA256
8ea9c5b6af17446b164b3aab8e52907d5c31b16c3e71690a40832a22a9fc8a2a
-
SHA512
057825daec09487f7ca784430d16247dd64b2ff018aadbe84164f4710403fb291319d26d4855a508b26fdb840327483931c24413ddd8ad060093fecec4ba8c64
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-