General
-
Target
b45e734ae4ddc52234ca1bde5781834ed3f04e1ce2a2c0e09c8720360e1102a6
-
Size
2.3MB
-
Sample
220220-pamypscedl
-
MD5
4bb0a120d0b51dae6d3b784ba4c29245
-
SHA1
e9c76fc16b212fc3c0f23bac20acd13e9a7df656
-
SHA256
b45e734ae4ddc52234ca1bde5781834ed3f04e1ce2a2c0e09c8720360e1102a6
-
SHA512
d86b9d53dc0e83390ff6c6f37ebef7431061cc1013b3cdb22e718c5aa46e1a1b9df6ad54eeae0f90a6ed9f16ef0e9101d9fd5a2ffe0552939dd608db3e0bc214
Static task
static1
Behavioral task
behavioral1
Sample
b45e734ae4ddc52234ca1bde5781834ed3f04e1ce2a2c0e09c8720360e1102a6.exe
Resource
win7-en-20211208
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-fms.resources\1\Information.txt
qulab
http://teleg.run/QulabZ
Extracted
C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-font-fms.resources\1\Information.txt
qulab
http://teleg.run/QulabZ
Targets
-
-
Target
b45e734ae4ddc52234ca1bde5781834ed3f04e1ce2a2c0e09c8720360e1102a6
-
Size
2.3MB
-
MD5
4bb0a120d0b51dae6d3b784ba4c29245
-
SHA1
e9c76fc16b212fc3c0f23bac20acd13e9a7df656
-
SHA256
b45e734ae4ddc52234ca1bde5781834ed3f04e1ce2a2c0e09c8720360e1102a6
-
SHA512
d86b9d53dc0e83390ff6c6f37ebef7431061cc1013b3cdb22e718c5aa46e1a1b9df6ad54eeae0f90a6ed9f16ef0e9101d9fd5a2ffe0552939dd608db3e0bc214
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-