General
-
Target
file
-
Size
284KB
-
Sample
220925-ecmqlsdba2
-
MD5
1d641364bd0f59de6b2d04e377c43e00
-
SHA1
a233c753f0e2029aeb51ad2c83caecf659a0dbe8
-
SHA256
e2da3fe6413e3179962df95e4b1053624d04d344a6fc2569802c399034cd7ab5
-
SHA512
048fec014c7a1b72d8b85b671ee5a1e4a0a4edf19779ff27691409bc83d8606c1439ab641eb4ad12643c7eaf64042a3e353d97e8e26a59b8bf061e2b95b52965
-
SSDEEP
3072:vLOGALx3IIfSN5HbPjhN2jUhZg5k9zMllW2BiC0xcnJWeVta28mVyRwBZU/PkkXx:kLxjf4bF0jUbgmZu9iC06Jbm28mVy
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Malware Config
Extracted
nymaim
208.67.104.97
85.31.46.167
Targets
-
-
Target
file
-
Size
284KB
-
MD5
1d641364bd0f59de6b2d04e377c43e00
-
SHA1
a233c753f0e2029aeb51ad2c83caecf659a0dbe8
-
SHA256
e2da3fe6413e3179962df95e4b1053624d04d344a6fc2569802c399034cd7ab5
-
SHA512
048fec014c7a1b72d8b85b671ee5a1e4a0a4edf19779ff27691409bc83d8606c1439ab641eb4ad12643c7eaf64042a3e353d97e8e26a59b8bf061e2b95b52965
-
SSDEEP
3072:vLOGALx3IIfSN5HbPjhN2jUhZg5k9zMllW2BiC0xcnJWeVta28mVyRwBZU/PkkXx:kLxjf4bF0jUbgmZu9iC06Jbm28mVy
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-