General
-
Target
Interac-e-Transfer.zip
-
Size
1.8MB
-
Sample
220809-tg48sacefp
-
MD5
4f3de62e57147ba762c86d99112acc45
-
SHA1
ba9a1dcddee381ad6d2c8b293261d507a4bfaf00
-
SHA256
6f6c56d0e723796b5f60dfd53fe0370cc6b33e0f61d3356213b689ea402fdab5
-
SHA512
a58eec86cd6456577c9e8be74183ca6bd7ebe0c5cfbc9bb0cb8236327692aa681c4186c0521e7024be2fa78a854591861a9beba645e829ea297645234a21b17d
Static task
static1
Behavioral task
behavioral1
Sample
ETRANSFER_RECEIPT.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
ETRANSFER_RECEIPT.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
bitrat
1.38
bitrat9300.duckdns.org:9300
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
tor_process
tor
Targets
-
-
Target
ETRANSFER_RECEIPT.exe
-
Size
300.0MB
-
MD5
8dac8b61bf8c23264873a3f3bee260f5
-
SHA1
ba581c38574794324ea714a48671fad7f2384dbe
-
SHA256
7e4a1f93d53d3962a913e000524344bdcccd6d36d0856b3df38df57d4a8e1df3
-
SHA512
65ef0b281583e1f8303ff470dc134d8d35ccc394521fd93294cd251220af501137b17d39af91829efe0191e395c2494e1652565895647bf04a46b56fe0eae163
-
Executes dropped EXE
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-