General
-
Target
fdddca79420fc7c66f7eef1d3d65252e29eecde5509ff50e8f6a26d34f98be20
-
Size
4.0MB
-
Sample
220920-a5gylsbgd5
-
MD5
2a31f5c75f23189a3c8df48d3ea275c4
-
SHA1
2ab7ebe52c010f9c8d26d48b4ad6bf9243cebc51
-
SHA256
fdddca79420fc7c66f7eef1d3d65252e29eecde5509ff50e8f6a26d34f98be20
-
SHA512
c75072ea79375ce005f10ead6122a9b4707710a8abc4459a0f24acf647bb1fbd5a839f482ef2e81bccbc4343e75e933bea22d3f2eb19db97a1d139020ebb6089
-
SSDEEP
98304:YzrvKS9C3HdXODRUIC3WJRR+rD/16QgvgjWARz1uoIxLCndy:2WggHoDRUIfMrD96PURwCy
Static task
static1
Malware Config
Targets
-
-
Target
fdddca79420fc7c66f7eef1d3d65252e29eecde5509ff50e8f6a26d34f98be20
-
Size
4.0MB
-
MD5
2a31f5c75f23189a3c8df48d3ea275c4
-
SHA1
2ab7ebe52c010f9c8d26d48b4ad6bf9243cebc51
-
SHA256
fdddca79420fc7c66f7eef1d3d65252e29eecde5509ff50e8f6a26d34f98be20
-
SHA512
c75072ea79375ce005f10ead6122a9b4707710a8abc4459a0f24acf647bb1fbd5a839f482ef2e81bccbc4343e75e933bea22d3f2eb19db97a1d139020ebb6089
-
SSDEEP
98304:YzrvKS9C3HdXODRUIC3WJRR+rD/16QgvgjWARz1uoIxLCndy:2WggHoDRUIfMrD96PURwCy
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-