General
-
Target
ExternalRun.exe
-
Size
274KB
-
Sample
220309-zqdebaeegr
-
MD5
63525b6ba838d80f0eb16a666ff30de2
-
SHA1
b11d70bf65b2b82df2c4aa46ac9dfce3c308b568
-
SHA256
3c8acfa90eed5ab18fd669bea9d494d9fb96f964d9040ee03ff9889dbaada294
-
SHA512
0709a2bb5d23ede0347e684a6512f0c282de68e3e7f1800ea1544e2f737cd77333bb0a496f6a0489d32df60e7d37760225e1fcac8d9905ae1b84d3de8ee348eb
Behavioral task
behavioral1
Sample
ExternalRun.exe
Resource
win7-20220223-en
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/947512216133980311/ImHpeYlo_A0Yhi0saM66pMBO7iLHhGK_k5MBohq8Jg4tn4gMe7dTpw1qEItYNQR_c9kp
Targets
-
-
Target
ExternalRun.exe
-
Size
274KB
-
MD5
63525b6ba838d80f0eb16a666ff30de2
-
SHA1
b11d70bf65b2b82df2c4aa46ac9dfce3c308b568
-
SHA256
3c8acfa90eed5ab18fd669bea9d494d9fb96f964d9040ee03ff9889dbaada294
-
SHA512
0709a2bb5d23ede0347e684a6512f0c282de68e3e7f1800ea1544e2f737cd77333bb0a496f6a0489d32df60e7d37760225e1fcac8d9905ae1b84d3de8ee348eb
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-