General
-
Target
61d49e4594358514557a0900bfbc2dab3e44fd7dc05b4a3fca18965def5618f7
-
Size
1.1MB
-
Sample
220730-ypk74aeghr
-
MD5
84307f2217068875dd710248c6f5fedf
-
SHA1
b50a577ae232e66e8efe1dc01aa0487bdb8143df
-
SHA256
61d49e4594358514557a0900bfbc2dab3e44fd7dc05b4a3fca18965def5618f7
-
SHA512
cc62489136fb276da7515f9aff881d5d0d10c804eb981d55e6d4dea7a890bdad24ed4249b6cc172a3ffa33ef3c7ff94dd44f009296d9ec55dc4891f2a691c60f
Static task
static1
Behavioral task
behavioral1
Sample
61d49e4594358514557a0900bfbc2dab3e44fd7dc05b4a3fca18965def5618f7.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
61d49e4594358514557a0900bfbc2dab3e44fd7dc05b4a3fca18965def5618f7.exe
Resource
win10v2004-20220722-en
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Targets
-
-
Target
61d49e4594358514557a0900bfbc2dab3e44fd7dc05b4a3fca18965def5618f7
-
Size
1.1MB
-
MD5
84307f2217068875dd710248c6f5fedf
-
SHA1
b50a577ae232e66e8efe1dc01aa0487bdb8143df
-
SHA256
61d49e4594358514557a0900bfbc2dab3e44fd7dc05b4a3fca18965def5618f7
-
SHA512
cc62489136fb276da7515f9aff881d5d0d10c804eb981d55e6d4dea7a890bdad24ed4249b6cc172a3ffa33ef3c7ff94dd44f009296d9ec55dc4891f2a691c60f
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-