General
-
Target
0d2397aa369dfc59c1b4f98d8b876505c88b2ff67f073f62722d59ce984da8d6
-
Size
2.2MB
-
Sample
220130-t1t7xsfbd2
-
MD5
ebb369c2ad96eb9ec566c6775bc0a308
-
SHA1
af21ca133a1a36491bd4f8882368f5bcc730809f
-
SHA256
0d2397aa369dfc59c1b4f98d8b876505c88b2ff67f073f62722d59ce984da8d6
-
SHA512
e450f4141e413fa90b24868d69ab074ed675545555fbd32dd2593bd6f604db4e6d2549739291bf387def690d9c503fe1200f0be3b57bec5367c54654d200662c
Static task
static1
Behavioral task
behavioral1
Sample
0d2397aa369dfc59c1b4f98d8b876505c88b2ff67f073f62722d59ce984da8d6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0d2397aa369dfc59c1b4f98d8b876505c88b2ff67f073f62722d59ce984da8d6.exe
Resource
win10-en-20211208
Malware Config
Extracted
bitrat
1.35
publiquilla.linkpc.net:9089
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
windowssecurirysercivehealtht
-
install_file
windowssecuritrysercive.exe
-
tor_process
tor
Targets
-
-
Target
0d2397aa369dfc59c1b4f98d8b876505c88b2ff67f073f62722d59ce984da8d6
-
Size
2.2MB
-
MD5
ebb369c2ad96eb9ec566c6775bc0a308
-
SHA1
af21ca133a1a36491bd4f8882368f5bcc730809f
-
SHA256
0d2397aa369dfc59c1b4f98d8b876505c88b2ff67f073f62722d59ce984da8d6
-
SHA512
e450f4141e413fa90b24868d69ab074ed675545555fbd32dd2593bd6f604db4e6d2549739291bf387def690d9c503fe1200f0be3b57bec5367c54654d200662c
Score10/10-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-