General
-
Target
fd05e5f2b162d155c7527d016229ef8e9acd1a571de83688a38cfc567f00b008
-
Size
4.2MB
-
Sample
220927-ks795seban
-
MD5
8d528aa55569f63e02451c59c9bb81bf
-
SHA1
b39ec2f4acb78e97ead58fe5ffd021ac1494032f
-
SHA256
fd05e5f2b162d155c7527d016229ef8e9acd1a571de83688a38cfc567f00b008
-
SHA512
79c97563f70286ad26358b3008dcfce65a93e1a24eeef66b682e705a8818e9928a83aec5089e0ceb10a8f343a1ee690bf0f1053158d76e78eccf4c78726286f2
-
SSDEEP
98304:HiK9U1OXnxl8BUP46YnGMhX9Fai76ABfT5zPb4h1MVwJ:CxOzw6YnGMhX9FaiVBbdqwy
Static task
static1
Malware Config
Targets
-
-
Target
fd05e5f2b162d155c7527d016229ef8e9acd1a571de83688a38cfc567f00b008
-
Size
4.2MB
-
MD5
8d528aa55569f63e02451c59c9bb81bf
-
SHA1
b39ec2f4acb78e97ead58fe5ffd021ac1494032f
-
SHA256
fd05e5f2b162d155c7527d016229ef8e9acd1a571de83688a38cfc567f00b008
-
SHA512
79c97563f70286ad26358b3008dcfce65a93e1a24eeef66b682e705a8818e9928a83aec5089e0ceb10a8f343a1ee690bf0f1053158d76e78eccf4c78726286f2
-
SSDEEP
98304:HiK9U1OXnxl8BUP46YnGMhX9Fai76ABfT5zPb4h1MVwJ:CxOzw6YnGMhX9FaiVBbdqwy
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-