General
-
Target
1bb367ff3450a5f0b9c60090cde67f7412b5bc8590622f3f8a6a5d66addaf721
-
Size
1.4MB
-
Sample
220607-wf1v3sehd6
-
MD5
61d264f734124d172092b1598a913121
-
SHA1
b81eb8c181195437fcc9581cc3eb99f170b2e61d
-
SHA256
1bb367ff3450a5f0b9c60090cde67f7412b5bc8590622f3f8a6a5d66addaf721
-
SHA512
aaff6de481b8eaeb61e2948c715a7bcaea9beac154bb04b527c698877158350651f8ad8b4d74e5207c9552f740af85461cc7be4263b07a0228adf3760477251e
Static task
static1
Behavioral task
behavioral1
Sample
1bb367ff3450a5f0b9c60090cde67f7412b5bc8590622f3f8a6a5d66addaf721.exe
Resource
win7-20220414-en
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Targets
-
-
Target
1bb367ff3450a5f0b9c60090cde67f7412b5bc8590622f3f8a6a5d66addaf721
-
Size
1.4MB
-
MD5
61d264f734124d172092b1598a913121
-
SHA1
b81eb8c181195437fcc9581cc3eb99f170b2e61d
-
SHA256
1bb367ff3450a5f0b9c60090cde67f7412b5bc8590622f3f8a6a5d66addaf721
-
SHA512
aaff6de481b8eaeb61e2948c715a7bcaea9beac154bb04b527c698877158350651f8ad8b4d74e5207c9552f740af85461cc7be4263b07a0228adf3760477251e
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-