General
-
Target
10c0effd5486df6f15515bf0fa1e2e0f63f16e2e225d7675121cfc6278132689
-
Size
502KB
-
Sample
220222-w78p1addfn
-
MD5
673c1b160eafff2d04c42b1b08102614
-
SHA1
d7ff86767a0e1cd7221d7f03ce8c36aadbe60bca
-
SHA256
10c0effd5486df6f15515bf0fa1e2e0f63f16e2e225d7675121cfc6278132689
-
SHA512
3cded3dfe9c6b4a48cc2767bc48b8c57f4ba31b0c5e78ebce9a36a264be0f99d02c5ccd9e8c2dabb2bd49f057987e2a05edd1718a07184cc42fa0e08cb69d1e4
Static task
static1
Behavioral task
behavioral1
Sample
10c0effd5486df6f15515bf0fa1e2e0f63f16e2e225d7675121cfc6278132689.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
10c0effd5486df6f15515bf0fa1e2e0f63f16e2e225d7675121cfc6278132689.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
10c0effd5486df6f15515bf0fa1e2e0f63f16e2e225d7675121cfc6278132689
-
Size
502KB
-
MD5
673c1b160eafff2d04c42b1b08102614
-
SHA1
d7ff86767a0e1cd7221d7f03ce8c36aadbe60bca
-
SHA256
10c0effd5486df6f15515bf0fa1e2e0f63f16e2e225d7675121cfc6278132689
-
SHA512
3cded3dfe9c6b4a48cc2767bc48b8c57f4ba31b0c5e78ebce9a36a264be0f99d02c5ccd9e8c2dabb2bd49f057987e2a05edd1718a07184cc42fa0e08cb69d1e4
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-