General
-
Target
1a5b6432aeffabd0b854b3cbb3f034ba4939a530eec64d3bd92b62c4f4e06116
-
Size
4.1MB
-
Sample
220928-lbrfqsgfcq
-
MD5
80f1d12b21aba9d3344c56fe07255fc0
-
SHA1
2bf1427664f4a4208c08c15625edf2cad1a53382
-
SHA256
1a5b6432aeffabd0b854b3cbb3f034ba4939a530eec64d3bd92b62c4f4e06116
-
SHA512
073669c1c627a08cc83de08d034590748cd5bf6fe4066febad92be8e96f62556e03aec529df5889c97a40100f673030bb3236ed5b1d1833e5daef4768479c900
-
SSDEEP
98304:Ft6Tg9kFWNy2OLBmno/ZcKpRaVKfdNfojscJrxaWcBNos+fwb4:v6Tg9kFWNyVmno/ZcKrN9MsOrxaWCMfr
Static task
static1
Malware Config
Targets
-
-
Target
1a5b6432aeffabd0b854b3cbb3f034ba4939a530eec64d3bd92b62c4f4e06116
-
Size
4.1MB
-
MD5
80f1d12b21aba9d3344c56fe07255fc0
-
SHA1
2bf1427664f4a4208c08c15625edf2cad1a53382
-
SHA256
1a5b6432aeffabd0b854b3cbb3f034ba4939a530eec64d3bd92b62c4f4e06116
-
SHA512
073669c1c627a08cc83de08d034590748cd5bf6fe4066febad92be8e96f62556e03aec529df5889c97a40100f673030bb3236ed5b1d1833e5daef4768479c900
-
SSDEEP
98304:Ft6Tg9kFWNy2OLBmno/ZcKpRaVKfdNfojscJrxaWcBNos+fwb4:v6Tg9kFWNyVmno/ZcKrN9MsOrxaWCMfr
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-