General
-
Target
00fa5e8594b86eae0525931525c1097a9148996d83b1818600ec4c159551e6cb
-
Size
4.1MB
-
Sample
220917-rxddwshhf4
-
MD5
082466214d0f6fea122a7c489a3e314d
-
SHA1
326058da9c693f3c33be5d6a3108df119a9ae4fc
-
SHA256
00fa5e8594b86eae0525931525c1097a9148996d83b1818600ec4c159551e6cb
-
SHA512
03a84174fa9fcbbe87cd08eaee42e296778a87bf938818f9e25737a66c3fdb11447343b0e5d36ce1ee833f4c302f3a3ad2c65ec244c6c16e78253672ccaf08d9
-
SSDEEP
98304:btGLjn0HXiPV5zHqSXROpIGLO27qi/R4RLXcAHLbvOF:pGLjn0HyrzHjaIGLObeRMcAH/E
Static task
static1
Malware Config
Targets
-
-
Target
00fa5e8594b86eae0525931525c1097a9148996d83b1818600ec4c159551e6cb
-
Size
4.1MB
-
MD5
082466214d0f6fea122a7c489a3e314d
-
SHA1
326058da9c693f3c33be5d6a3108df119a9ae4fc
-
SHA256
00fa5e8594b86eae0525931525c1097a9148996d83b1818600ec4c159551e6cb
-
SHA512
03a84174fa9fcbbe87cd08eaee42e296778a87bf938818f9e25737a66c3fdb11447343b0e5d36ce1ee833f4c302f3a3ad2c65ec244c6c16e78253672ccaf08d9
-
SSDEEP
98304:btGLjn0HXiPV5zHqSXROpIGLO27qi/R4RLXcAHLbvOF:pGLjn0HyrzHjaIGLObeRMcAH/E
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-