General
-
Target
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
-
Size
883KB
-
Sample
220725-tldxdshfck
-
MD5
621bbd51e44db9b507a911ceba8c6e4d
-
SHA1
524a771f04ee76bddc16d5a6c0d59ac4f97b3398
-
SHA256
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
-
SHA512
b33de89cbebe427ee84e6b4ecc08e7635b6fa01f37a85f87c571d804db69774eb7df5fe623d262b195a59fb78a267daab8f636278599484c231be2905d9fe3c8
Static task
static1
Behavioral task
behavioral1
Sample
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31.exe
Resource
win7-20220715-en
Malware Config
Targets
-
-
Target
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
-
Size
883KB
-
MD5
621bbd51e44db9b507a911ceba8c6e4d
-
SHA1
524a771f04ee76bddc16d5a6c0d59ac4f97b3398
-
SHA256
5568f17165b2499bfb5fe5eefaf6d8e571c8d5168ef32740bcb26679c612ea31
-
SHA512
b33de89cbebe427ee84e6b4ecc08e7635b6fa01f37a85f87c571d804db69774eb7df5fe623d262b195a59fb78a267daab8f636278599484c231be2905d9fe3c8
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-