Overview
overview
10Static
static
8install.bat
windows7_x64
10install.bat
windows10-2004_x64
10install.vbs
windows7_x64
10install.vbs
windows10-2004_x64
10mailsend.exe
windows7_x64
1mailsend.exe
windows10-2004_x64
1rfusclient.exe
windows7_x64
1rfusclient.exe
windows10-2004_x64
1rutserv.exe
windows7_x64
10rutserv.exe
windows10-2004_x64
10vp8decoder.dll
windows7_x64
1vp8decoder.dll
windows10-2004_x64
1vp8encoder.dll
windows7_x64
1vp8encoder.dll
windows10-2004_x64
1Analysis
-
max time kernel
110s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
17-03-2022 01:27
Static task
static1
Behavioral task
behavioral1
Sample
install.bat
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
install.bat
Resource
win10v2004-20220310-en
Behavioral task
behavioral3
Sample
install.vbs
Resource
win7-20220311-en
Behavioral task
behavioral4
Sample
install.vbs
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
mailsend.exe
Resource
win7-20220310-en
Behavioral task
behavioral6
Sample
mailsend.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
rfusclient.exe
Resource
win7-20220310-en
Behavioral task
behavioral8
Sample
rfusclient.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral9
Sample
rutserv.exe
Resource
win7-20220311-en
Behavioral task
behavioral10
Sample
rutserv.exe
Resource
win10v2004-20220310-en
Behavioral task
behavioral11
Sample
vp8decoder.dll
Resource
win7-20220311-en
Behavioral task
behavioral12
Sample
vp8decoder.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral13
Sample
vp8encoder.dll
Resource
win7-20220311-en
Behavioral task
behavioral14
Sample
vp8encoder.dll
Resource
win10v2004-20220310-en
General
-
Target
mailsend.exe
-
Size
1.2MB
-
MD5
ac23b87f8ec60ddd3f555556f89a6af8
-
SHA1
3cea6f84757d15ee8d7fa19d3dfc4992c50aa90c
-
SHA256
80a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4
-
SHA512
57e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3364 mailsend.exe 3364 mailsend.exe