General
-
Target
40d0585cbfa2a6ca28506cec1534193fa4dcdc1df220a69c2c7f2438e4ed68c1
-
Size
741KB
-
Sample
220708-k92tpadag7
-
MD5
3ca3094ef98c38bc6f952367477f7210
-
SHA1
b1c1d28cd51fa239846eba862b641ddbead0fd4b
-
SHA256
40d0585cbfa2a6ca28506cec1534193fa4dcdc1df220a69c2c7f2438e4ed68c1
-
SHA512
28d33f3abdd41aa769109116cb78dd1d1d9362db72cf9e23dea2f49aa3b4353c050edb51d40e6c7c678c8432b48a172c92e1d2a8b602dec606d557893f71630f
Static task
static1
Behavioral task
behavioral1
Sample
40d0585cbfa2a6ca28506cec1534193fa4dcdc1df220a69c2c7f2438e4ed68c1.exe
Resource
win7-20220414-en
Malware Config
Targets
-
-
Target
40d0585cbfa2a6ca28506cec1534193fa4dcdc1df220a69c2c7f2438e4ed68c1
-
Size
741KB
-
MD5
3ca3094ef98c38bc6f952367477f7210
-
SHA1
b1c1d28cd51fa239846eba862b641ddbead0fd4b
-
SHA256
40d0585cbfa2a6ca28506cec1534193fa4dcdc1df220a69c2c7f2438e4ed68c1
-
SHA512
28d33f3abdd41aa769109116cb78dd1d1d9362db72cf9e23dea2f49aa3b4353c050edb51d40e6c7c678c8432b48a172c92e1d2a8b602dec606d557893f71630f
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-