General
-
Target
c1cbc33ffd320ea7657a732db883c989370e501fd902dcabfc8a1924b9e4d16b
-
Size
138KB
-
Sample
220731-ga948sbbc9
-
MD5
ea193f350cbcdd48d5bd55e7ea934838
-
SHA1
b22ca46d1da866f4675916580cf2e8cb690f984b
-
SHA256
c1cbc33ffd320ea7657a732db883c989370e501fd902dcabfc8a1924b9e4d16b
-
SHA512
b84dec2a5a9f01d051021018e3f67fc545c11b1d3aec329e95495d411fa7d761feac66034eeea33974260b8c9974111897a51fb50bd68ec71e507d4bcdc22e65
Static task
static1
Behavioral task
behavioral1
Sample
c1cbc33ffd320ea7657a732db883c989370e501fd902dcabfc8a1924b9e4d16b.dll
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
c1cbc33ffd320ea7657a732db883c989370e501fd902dcabfc8a1924b9e4d16b.dll
Resource
win10v2004-20220722-en
Malware Config
Extracted
hancitor
1912_372823
http://howeelyzuq.com/4/forum.php
http://thriondery.ru/4/forum.php
http://craledlopj.ru/4/forum.php
Targets
-
-
Target
c1cbc33ffd320ea7657a732db883c989370e501fd902dcabfc8a1924b9e4d16b
-
Size
138KB
-
MD5
ea193f350cbcdd48d5bd55e7ea934838
-
SHA1
b22ca46d1da866f4675916580cf2e8cb690f984b
-
SHA256
c1cbc33ffd320ea7657a732db883c989370e501fd902dcabfc8a1924b9e4d16b
-
SHA512
b84dec2a5a9f01d051021018e3f67fc545c11b1d3aec329e95495d411fa7d761feac66034eeea33974260b8c9974111897a51fb50bd68ec71e507d4bcdc22e65
Score10/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-