General
-
Target
228ed897d96e7f5c588a0e1b7a2f7a97e1145ac81cb5ef92af7a0c0d3fa78075
-
Size
2.3MB
-
Sample
220612-ffnmrabbf8
-
MD5
b2786685ef7d2bd36100a8b68a6ace40
-
SHA1
91df42741d67f5aad789ae282804d8f3cfcac40c
-
SHA256
228ed897d96e7f5c588a0e1b7a2f7a97e1145ac81cb5ef92af7a0c0d3fa78075
-
SHA512
389e0e8d696eec31e2e03b1dd2f5ddbf0f515481c9726aa8cae02632ba36820f6a6fcf856b7c03054f6477bd02af36b0395a33966a2016766f4daa3ab26a4b53
Static task
static1
Behavioral task
behavioral1
Sample
228ed897d96e7f5c588a0e1b7a2f7a97e1145ac81cb5ef92af7a0c0d3fa78075.exe
Resource
win7-20220414-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-mfplat.resources\1\Information.txt
qulab
http://teleg.run/QulabZ
Extracted
C:\Users\Admin\AppData\Roaming\x86_microsoft-windows-mfplat.resources\1\Information.txt
qulab
http://teleg.run/QulabZ
Targets
-
-
Target
228ed897d96e7f5c588a0e1b7a2f7a97e1145ac81cb5ef92af7a0c0d3fa78075
-
Size
2.3MB
-
MD5
b2786685ef7d2bd36100a8b68a6ace40
-
SHA1
91df42741d67f5aad789ae282804d8f3cfcac40c
-
SHA256
228ed897d96e7f5c588a0e1b7a2f7a97e1145ac81cb5ef92af7a0c0d3fa78075
-
SHA512
389e0e8d696eec31e2e03b1dd2f5ddbf0f515481c9726aa8cae02632ba36820f6a6fcf856b7c03054f6477bd02af36b0395a33966a2016766f4daa3ab26a4b53
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-