General
-
Target
84e8655e35cfa24d58004b037d4a6c65191c6ed8e403bccefaaed7a042ad8c26
-
Size
777KB
-
Sample
221003-c1ec2acdc9
-
MD5
ecb9823469828bf5bd9a2ac05b026a0a
-
SHA1
db6eeba0fd23c06e2a6fc5a052ca54e396bb11b0
-
SHA256
84e8655e35cfa24d58004b037d4a6c65191c6ed8e403bccefaaed7a042ad8c26
-
SHA512
19ab614cc8ee1a779544cd53e9aa519b3c8523551aa24f05c9433d587bb23a5ad5bb6e6d5a08781fcef4c4de990af699f0bf38a7c549a868bed1cc18b69c5e4d
-
SSDEEP
12288:+y1U6sce2KztyudNBRsKOdoN3Av/DB7pgK+jlsZ8SJUvLcSW:+wwTDw+NQ3DElsCSD
Static task
static1
Behavioral task
behavioral1
Sample
84e8655e35cfa24d58004b037d4a6c65191c6ed8e403bccefaaed7a042ad8c26.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
84e8655e35cfa24d58004b037d4a6c65191c6ed8e403bccefaaed7a042ad8c26.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
84e8655e35cfa24d58004b037d4a6c65191c6ed8e403bccefaaed7a042ad8c26
-
Size
777KB
-
MD5
ecb9823469828bf5bd9a2ac05b026a0a
-
SHA1
db6eeba0fd23c06e2a6fc5a052ca54e396bb11b0
-
SHA256
84e8655e35cfa24d58004b037d4a6c65191c6ed8e403bccefaaed7a042ad8c26
-
SHA512
19ab614cc8ee1a779544cd53e9aa519b3c8523551aa24f05c9433d587bb23a5ad5bb6e6d5a08781fcef4c4de990af699f0bf38a7c549a868bed1cc18b69c5e4d
-
SSDEEP
12288:+y1U6sce2KztyudNBRsKOdoN3Av/DB7pgK+jlsZ8SJUvLcSW:+wwTDw+NQ3DElsCSD
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-