General
-
Target
2cb326bf23a15dfa548df0266743efffefe1cb91450b3146e03e72f51c2cf0d9.exe
-
Size
1.1MB
-
Sample
220208-wmnt4acfg7
-
MD5
d163e4d75e3e115cce99679d08595c6e
-
SHA1
a859952a86158d2f60ed927a966d17eede94887d
-
SHA256
2cb326bf23a15dfa548df0266743efffefe1cb91450b3146e03e72f51c2cf0d9
-
SHA512
e43b7db81a24c0b27df91f0fac967be0e2089b3b74ea3b431be47a900e73c5f5bf498da14921edbfa397ff3f5d767716ff60a5ca10d1ff7f213d9d20023b6413
Static task
static1
Behavioral task
behavioral1
Sample
2cb326bf23a15dfa548df0266743efffefe1cb91450b3146e03e72f51c2cf0d9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2cb326bf23a15dfa548df0266743efffefe1cb91450b3146e03e72f51c2cf0d9.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
raccoon
125d9f8ed76e486f6563be097a710bd4cba7f7f2
-
url4cnc
http://5.252.178.180/brikitiki
https://t.me/brikitiki
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
pretorian.ug
Targets
-
-
Target
2cb326bf23a15dfa548df0266743efffefe1cb91450b3146e03e72f51c2cf0d9.exe
-
Size
1.1MB
-
MD5
d163e4d75e3e115cce99679d08595c6e
-
SHA1
a859952a86158d2f60ed927a966d17eede94887d
-
SHA256
2cb326bf23a15dfa548df0266743efffefe1cb91450b3146e03e72f51c2cf0d9
-
SHA512
e43b7db81a24c0b27df91f0fac967be0e2089b3b74ea3b431be47a900e73c5f5bf498da14921edbfa397ff3f5d767716ff60a5ca10d1ff7f213d9d20023b6413
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader First Stage
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-