General
-
Target
3c0ead422aba2eaba8967431b9bfd5e116511c48c54da5998455e29ff7a92f28
-
Size
502KB
-
Sample
220703-kpg9jsceaj
-
MD5
551dcf42025409fbf4a2f27ac5e55e46
-
SHA1
8626f306e7d3a726c30e095da975355a584b92ac
-
SHA256
3c0ead422aba2eaba8967431b9bfd5e116511c48c54da5998455e29ff7a92f28
-
SHA512
a88536ce7de0f5f1e11631ddd48602a7e7ffcf733c7ecfc0d3c50a72e88b1c1c8555fd6441585db6ae1ba28f1a81af3aa0a89675a0af1b9632995a77cb26d284
Static task
static1
Behavioral task
behavioral1
Sample
3c0ead422aba2eaba8967431b9bfd5e116511c48c54da5998455e29ff7a92f28.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3c0ead422aba2eaba8967431b9bfd5e116511c48c54da5998455e29ff7a92f28.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.zoho.com - Port:
587 - Username:
meduzaferguson1313@zoho.com - Password:
Meduza231
Targets
-
-
Target
3c0ead422aba2eaba8967431b9bfd5e116511c48c54da5998455e29ff7a92f28
-
Size
502KB
-
MD5
551dcf42025409fbf4a2f27ac5e55e46
-
SHA1
8626f306e7d3a726c30e095da975355a584b92ac
-
SHA256
3c0ead422aba2eaba8967431b9bfd5e116511c48c54da5998455e29ff7a92f28
-
SHA512
a88536ce7de0f5f1e11631ddd48602a7e7ffcf733c7ecfc0d3c50a72e88b1c1c8555fd6441585db6ae1ba28f1a81af3aa0a89675a0af1b9632995a77cb26d284
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-