General
-
Target
56a5356d46b18693618a5285d2a106006ded77dca4e05db3ada36c00334f7ddf
-
Size
730KB
-
Sample
220725-dswssacdh8
-
MD5
524983eb522687bb2ec861ed6ade8739
-
SHA1
67b58d2269902fc2c7ce52290a5d4513bc73a290
-
SHA256
56a5356d46b18693618a5285d2a106006ded77dca4e05db3ada36c00334f7ddf
-
SHA512
c1d2c93f0be8200c917be929cda124a93a5ccc425ab833ccb2d3db1e8533b0f28413c19ce6b6bd0b90756bd6666a3c61562f62549a7f25e964b2e0d7c3fe208f
Static task
static1
Behavioral task
behavioral1
Sample
56a5356d46b18693618a5285d2a106006ded77dca4e05db3ada36c00334f7ddf.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
56a5356d46b18693618a5285d2a106006ded77dca4e05db3ada36c00334f7ddf.exe
Resource
win10v2004-20220721-en
Malware Config
Targets
-
-
Target
56a5356d46b18693618a5285d2a106006ded77dca4e05db3ada36c00334f7ddf
-
Size
730KB
-
MD5
524983eb522687bb2ec861ed6ade8739
-
SHA1
67b58d2269902fc2c7ce52290a5d4513bc73a290
-
SHA256
56a5356d46b18693618a5285d2a106006ded77dca4e05db3ada36c00334f7ddf
-
SHA512
c1d2c93f0be8200c917be929cda124a93a5ccc425ab833ccb2d3db1e8533b0f28413c19ce6b6bd0b90756bd6666a3c61562f62549a7f25e964b2e0d7c3fe208f
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-