General
-
Target
9e7f82a94f2c370595b1961a6c1deebc72067f301ac0ed9b7eada097a5f5de54
-
Size
4.0MB
-
Sample
220923-wag6saheg9
-
MD5
199253e00e9e81a3409658b2b7a3cca8
-
SHA1
d018a6bb605cde98a56bcee2725d8c427c8aad5a
-
SHA256
9e7f82a94f2c370595b1961a6c1deebc72067f301ac0ed9b7eada097a5f5de54
-
SHA512
648f7752417641c5b70e7c57992c7a509c7f88a430fde9febb759ffba515cfc240f9e8a75d8f3e3db604994b4a3c2d91f89ec16e708e0894c6c6b6748347ad64
-
SSDEEP
98304:3gA+JOCfNzCO73pnpMV+XW8GBvaMo8fGf1VbC1F:aOClOODpp2+4vaf8fGtVbsF
Static task
static1
Malware Config
Targets
-
-
Target
9e7f82a94f2c370595b1961a6c1deebc72067f301ac0ed9b7eada097a5f5de54
-
Size
4.0MB
-
MD5
199253e00e9e81a3409658b2b7a3cca8
-
SHA1
d018a6bb605cde98a56bcee2725d8c427c8aad5a
-
SHA256
9e7f82a94f2c370595b1961a6c1deebc72067f301ac0ed9b7eada097a5f5de54
-
SHA512
648f7752417641c5b70e7c57992c7a509c7f88a430fde9febb759ffba515cfc240f9e8a75d8f3e3db604994b4a3c2d91f89ec16e708e0894c6c6b6748347ad64
-
SSDEEP
98304:3gA+JOCfNzCO73pnpMV+XW8GBvaMo8fGf1VbC1F:aOClOODpp2+4vaf8fGtVbsF
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-