General
-
Target
DOCUMENTO ORDINARIO.exe
-
Size
4.4MB
-
Sample
220810-mz2r2shdaj
-
MD5
d30119efcade19d0ed3ae5cd84ff7423
-
SHA1
3ab05af68868dcffc190ce570f9ec53f16116cfd
-
SHA256
cc65ae06615f6fac3823126248fb294923b983c2c115ff1ab59806f3072b75ef
-
SHA512
de5a4fa338c620ee94fdd9c64a67df4a78bdbd62d6dfc78a999a04d4ee0a6fd112f7c45c7dfc635690b8c67fd9256584f7ff146f060f63596dbeae26f3afe370
Static task
static1
Behavioral task
behavioral1
Sample
DOCUMENTO ORDINARIO.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
DOCUMENTO ORDINARIO.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
bitrat
1.38
vhsivhyugve.duckdns.org:1880
-
communication_password
202cb962ac59075b964b07152d234b70
-
tor_process
tor
Targets
-
-
Target
DOCUMENTO ORDINARIO.exe
-
Size
4.4MB
-
MD5
d30119efcade19d0ed3ae5cd84ff7423
-
SHA1
3ab05af68868dcffc190ce570f9ec53f16116cfd
-
SHA256
cc65ae06615f6fac3823126248fb294923b983c2c115ff1ab59806f3072b75ef
-
SHA512
de5a4fa338c620ee94fdd9c64a67df4a78bdbd62d6dfc78a999a04d4ee0a6fd112f7c45c7dfc635690b8c67fd9256584f7ff146f060f63596dbeae26f3afe370
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-