General
-
Target
KPSFEGLI.EXE
-
Size
820KB
-
Sample
220503-vppczacgbm
-
MD5
1573b52c2d0b3d410e73a3a1495565d0
-
SHA1
c7f09d25eeda29012127e0511a361b73254d4170
-
SHA256
f7548d3107c311afddf7827c19a4154bf0e9359cc294e9169042ccd3cc290227
-
SHA512
fe8c7405d545e1dbadcdcd9fbec9f2496a654bfd4ee761f2a704265bbd0d65c88588930adac5e536974ecbe03793a1aa21a212fb1cc27530477e32baf41d0c06
Static task
static1
Behavioral task
behavioral1
Sample
KPSFEGLI.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
KPSFEGLI.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
bitrat
1.38
oka.nerdpol.ovh:2223
-
communication_password
b6c6e855edf908ec7c12ce8c8e628a5c
-
tor_process
tor
Targets
-
-
Target
KPSFEGLI.EXE
-
Size
820KB
-
MD5
1573b52c2d0b3d410e73a3a1495565d0
-
SHA1
c7f09d25eeda29012127e0511a361b73254d4170
-
SHA256
f7548d3107c311afddf7827c19a4154bf0e9359cc294e9169042ccd3cc290227
-
SHA512
fe8c7405d545e1dbadcdcd9fbec9f2496a654bfd4ee761f2a704265bbd0d65c88588930adac5e536974ecbe03793a1aa21a212fb1cc27530477e32baf41d0c06
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-