General
-
Target
SecuriteInfo.com.Trojan.DownLoader44.60226.4890.20245
-
Size
1.1MB
-
Sample
220518-n5tt3acbhl
-
MD5
9470b7c60f200376fbfbb74e587d8c51
-
SHA1
f86c90f8d03f2bc6ecf049aecf5ce24ae8022b86
-
SHA256
a3137a5eb92a73b35bb269d973ad2f7354f33ce6992d67e9b550c3105d1b962c
-
SHA512
fd9b8e3197a60c46c15c130ad8cca74aa973892837b54a3612442be27fa3a98e2d45889c1350300f4f3d2a8b93cde3cd5b1b5e733e7492f09cf6a44637d7b459
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.DownLoader44.60226.4890.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.DownLoader44.60226.4890.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
bitrat
1.38
oka.nerdpol.ovh:2223
-
communication_password
b6c6e855edf908ec7c12ce8c8e628a5c
-
tor_process
tor
Targets
-
-
Target
SecuriteInfo.com.Trojan.DownLoader44.60226.4890.20245
-
Size
1.1MB
-
MD5
9470b7c60f200376fbfbb74e587d8c51
-
SHA1
f86c90f8d03f2bc6ecf049aecf5ce24ae8022b86
-
SHA256
a3137a5eb92a73b35bb269d973ad2f7354f33ce6992d67e9b550c3105d1b962c
-
SHA512
fd9b8e3197a60c46c15c130ad8cca74aa973892837b54a3612442be27fa3a98e2d45889c1350300f4f3d2a8b93cde3cd5b1b5e733e7492f09cf6a44637d7b459
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-