Overview
overview
10Static
static
8install.bat
windows7_x64
10install.bat
windows10-2004_x64
10install.vbs
windows7_x64
10install.vbs
windows10-2004_x64
10mailsend.exe
windows7_x64
1mailsend.exe
windows10-2004_x64
1rfusclient.exe
windows7_x64
1rfusclient.exe
windows10-2004_x64
1rutserv.exe
windows7_x64
10rutserv.exe
windows10-2004_x64
10vp8decoder.dll
windows7_x64
1vp8decoder.dll
windows10-2004_x64
1vp8encoder.dll
windows7_x64
1vp8encoder.dll
windows10-2004_x64
1Analysis
-
max time kernel
124s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
17-03-2022 01:27
Static task
static1
Behavioral task
behavioral1
Sample
install.bat
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
install.bat
Resource
win10v2004-20220310-en
Behavioral task
behavioral3
Sample
install.vbs
Resource
win7-20220311-en
Behavioral task
behavioral4
Sample
install.vbs
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
mailsend.exe
Resource
win7-20220310-en
Behavioral task
behavioral6
Sample
mailsend.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
rfusclient.exe
Resource
win7-20220310-en
Behavioral task
behavioral8
Sample
rfusclient.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral9
Sample
rutserv.exe
Resource
win7-20220311-en
Behavioral task
behavioral10
Sample
rutserv.exe
Resource
win10v2004-20220310-en
Behavioral task
behavioral11
Sample
vp8decoder.dll
Resource
win7-20220311-en
Behavioral task
behavioral12
Sample
vp8decoder.dll
Resource
win10v2004-20220310-en
Behavioral task
behavioral13
Sample
vp8encoder.dll
Resource
win7-20220311-en
Behavioral task
behavioral14
Sample
vp8encoder.dll
Resource
win10v2004-20220310-en
General
-
Target
rfusclient.exe
-
Size
1.5MB
-
MD5
b8667a1e84567fcf7821bcefb6a444af
-
SHA1
9c1f91fe77ad357c8f81205d65c9067a270d61f0
-
SHA256
dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
-
SHA512
ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3356 rfusclient.exe 3356 rfusclient.exe