General
-
Target
6b429e9f32fe2972868633b216deeaaf0b834dc6797a2400f615e3bae477365d
-
Size
4.0MB
-
Sample
220923-gx7mmahcdj
-
MD5
4204d0e842b4d4bcc0b5e76a705aa9fe
-
SHA1
12ab454f80345a42ba35febead2acc6a27466c61
-
SHA256
6b429e9f32fe2972868633b216deeaaf0b834dc6797a2400f615e3bae477365d
-
SHA512
4f9862ac00d4187cf74527fc01ccdefa7d853d2b4b1e4f916f3a25d6b4f3e0e114a066bf22b8431037734db34f6c8b532438fa37fe37e319857187670c4c9a88
-
SSDEEP
98304:pgm1P1Db3Lri44J7cNvj/yKTWtF/E4zWC2GMhse:ucb/v4J707/yKTi/E4zWCwWe
Static task
static1
Malware Config
Targets
-
-
Target
6b429e9f32fe2972868633b216deeaaf0b834dc6797a2400f615e3bae477365d
-
Size
4.0MB
-
MD5
4204d0e842b4d4bcc0b5e76a705aa9fe
-
SHA1
12ab454f80345a42ba35febead2acc6a27466c61
-
SHA256
6b429e9f32fe2972868633b216deeaaf0b834dc6797a2400f615e3bae477365d
-
SHA512
4f9862ac00d4187cf74527fc01ccdefa7d853d2b4b1e4f916f3a25d6b4f3e0e114a066bf22b8431037734db34f6c8b532438fa37fe37e319857187670c4c9a88
-
SSDEEP
98304:pgm1P1Db3Lri44J7cNvj/yKTWtF/E4zWC2GMhse:ucb/v4J707/yKTi/E4zWCwWe
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-