General
-
Target
51f61848139d77c39e4d897f64e34600897ce1becba49292c0b8291608d6c20f
-
Size
1.3MB
-
Sample
220717-q8p2dsbgdn
-
MD5
cc9d7da955cfc3360189087489458d2e
-
SHA1
e73c60e35c4a2f46d0c7e4455830c5b44b3c11ee
-
SHA256
51f61848139d77c39e4d897f64e34600897ce1becba49292c0b8291608d6c20f
-
SHA512
15b154a23fbb9a099fd2967398a316f82b0a70c99f2028c387a4ee8d25b10ad4304ced000fa82287319d425c8828e7366ea01ec258b52eb5ccae5aa628ec1791
Static task
static1
Behavioral task
behavioral1
Sample
51f61848139d77c39e4d897f64e34600897ce1becba49292c0b8291608d6c20f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
51f61848139d77c39e4d897f64e34600897ce1becba49292c0b8291608d6c20f.exe
Resource
win10v2004-20220715-en
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Targets
-
-
Target
51f61848139d77c39e4d897f64e34600897ce1becba49292c0b8291608d6c20f
-
Size
1.3MB
-
MD5
cc9d7da955cfc3360189087489458d2e
-
SHA1
e73c60e35c4a2f46d0c7e4455830c5b44b3c11ee
-
SHA256
51f61848139d77c39e4d897f64e34600897ce1becba49292c0b8291608d6c20f
-
SHA512
15b154a23fbb9a099fd2967398a316f82b0a70c99f2028c387a4ee8d25b10ad4304ced000fa82287319d425c8828e7366ea01ec258b52eb5ccae5aa628ec1791
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-