General
-
Target
2e6b3018540b49803e4620aad0605775a5ffc765829418a12c6ffa7214d9d578
-
Size
1.0MB
-
Sample
220622-km97jsefg7
-
MD5
19e9776e8c45eab003baa27408b46c0c
-
SHA1
1b785eb0188d4be4ad90d9ddcd7fc309f9d841da
-
SHA256
2e6b3018540b49803e4620aad0605775a5ffc765829418a12c6ffa7214d9d578
-
SHA512
b9c002b77d3e9d8d1cef4efb69d3594bf8089a315602a626f482aa7512ffbb35301004e43d2777fc6b631c53158fc4fa9c17126e5300a17c64a8845f70b96667
Static task
static1
Behavioral task
behavioral1
Sample
2e6b3018540b49803e4620aad0605775a5ffc765829418a12c6ffa7214d9d578.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2e6b3018540b49803e4620aad0605775a5ffc765829418a12c6ffa7214d9d578.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
2e6b3018540b49803e4620aad0605775a5ffc765829418a12c6ffa7214d9d578
-
Size
1.0MB
-
MD5
19e9776e8c45eab003baa27408b46c0c
-
SHA1
1b785eb0188d4be4ad90d9ddcd7fc309f9d841da
-
SHA256
2e6b3018540b49803e4620aad0605775a5ffc765829418a12c6ffa7214d9d578
-
SHA512
b9c002b77d3e9d8d1cef4efb69d3594bf8089a315602a626f482aa7512ffbb35301004e43d2777fc6b631c53158fc4fa9c17126e5300a17c64a8845f70b96667
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-