General
-
Target
f9b76472156acf4791c07c0171638a4003833d90dcaf119a7ae3323382f6f70e
-
Size
4.0MB
-
Sample
220926-pmhvhsbhgj
-
MD5
b7e81e2114944613288218dd054c0269
-
SHA1
2b3f37e685d26ba63bd103cc838a8ca06a3005cb
-
SHA256
f9b76472156acf4791c07c0171638a4003833d90dcaf119a7ae3323382f6f70e
-
SHA512
600bf7ebcf69f181132605d25dc8da57b849735f17864c7da5efee36f5a2255de202ca6244f6e9002061a614f2c4902b76d1811ebc08bfb24a616eaabafb7ce1
-
SSDEEP
98304:hpEealvTWr+jckE/711hQrTWoyPSTTWkWTh:hp1U7a/7112rSoyPSXNWTh
Static task
static1
Malware Config
Targets
-
-
Target
f9b76472156acf4791c07c0171638a4003833d90dcaf119a7ae3323382f6f70e
-
Size
4.0MB
-
MD5
b7e81e2114944613288218dd054c0269
-
SHA1
2b3f37e685d26ba63bd103cc838a8ca06a3005cb
-
SHA256
f9b76472156acf4791c07c0171638a4003833d90dcaf119a7ae3323382f6f70e
-
SHA512
600bf7ebcf69f181132605d25dc8da57b849735f17864c7da5efee36f5a2255de202ca6244f6e9002061a614f2c4902b76d1811ebc08bfb24a616eaabafb7ce1
-
SSDEEP
98304:hpEealvTWr+jckE/711hQrTWoyPSTTWkWTh:hp1U7a/7112rSoyPSXNWTh
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-