General
-
Target
66e05c41c1bfcffdbf56740c4f8eaf1047770e492fb41a28f19828d0f3b47976
-
Size
684KB
-
Sample
221001-283g9sbea8
-
MD5
7bbb82fee2c36842a00fbd93a87dd6b0
-
SHA1
22e1c3282b0433d27e92615526b7ca804eb81261
-
SHA256
66e05c41c1bfcffdbf56740c4f8eaf1047770e492fb41a28f19828d0f3b47976
-
SHA512
8c9ae0ad4cb0373b10180a196e88ad94efdb82684d253524f8c9028992dad5412891a63f5ef44e61ef6daef13931d400db0d3bc82b95f2afb525301b9d0eba7d
-
SSDEEP
12288:v+poCqJgHaqP3Z42lUQ8yWIV24A/+QHxbeq8qQq33qIn5XoW2JuHPqKMY:DCj6qJ4trcDA/+G9e8rDPqKMY
Static task
static1
Behavioral task
behavioral1
Sample
66e05c41c1bfcffdbf56740c4f8eaf1047770e492fb41a28f19828d0f3b47976.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
66e05c41c1bfcffdbf56740c4f8eaf1047770e492fb41a28f19828d0f3b47976.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
jamesknt221@gmail.com - Password:
money12345
Targets
-
-
Target
66e05c41c1bfcffdbf56740c4f8eaf1047770e492fb41a28f19828d0f3b47976
-
Size
684KB
-
MD5
7bbb82fee2c36842a00fbd93a87dd6b0
-
SHA1
22e1c3282b0433d27e92615526b7ca804eb81261
-
SHA256
66e05c41c1bfcffdbf56740c4f8eaf1047770e492fb41a28f19828d0f3b47976
-
SHA512
8c9ae0ad4cb0373b10180a196e88ad94efdb82684d253524f8c9028992dad5412891a63f5ef44e61ef6daef13931d400db0d3bc82b95f2afb525301b9d0eba7d
-
SSDEEP
12288:v+poCqJgHaqP3Z42lUQ8yWIV24A/+QHxbeq8qQq33qIn5XoW2JuHPqKMY:DCj6qJ4trcDA/+G9e8rDPqKMY
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-