General
-
Target
abe375f6924b6046c337aa45601237b89236420336ad49da666bd06b75fcadf0
-
Size
4.1MB
-
Sample
221009-msb8tahabp
-
MD5
63f990953084335d540dcdb055f88a8e
-
SHA1
3b36b204999da670c6238111a6531605753052c1
-
SHA256
abe375f6924b6046c337aa45601237b89236420336ad49da666bd06b75fcadf0
-
SHA512
d429ca20aa49a4f8a0f106e139a9ce30c12c3879917c5ee016a5e4e79dd043e756a05978bccff01404dc5f243062868ec4eb873c671df287a072668d2bc9e375
-
SSDEEP
98304:H8ZKm4udCT0ToQlx8QzCui80ftahf0Mgggg51DFE:cZV/CT0ToYdzLi80VcW
Static task
static1
Malware Config
Targets
-
-
Target
abe375f6924b6046c337aa45601237b89236420336ad49da666bd06b75fcadf0
-
Size
4.1MB
-
MD5
63f990953084335d540dcdb055f88a8e
-
SHA1
3b36b204999da670c6238111a6531605753052c1
-
SHA256
abe375f6924b6046c337aa45601237b89236420336ad49da666bd06b75fcadf0
-
SHA512
d429ca20aa49a4f8a0f106e139a9ce30c12c3879917c5ee016a5e4e79dd043e756a05978bccff01404dc5f243062868ec4eb873c671df287a072668d2bc9e375
-
SSDEEP
98304:H8ZKm4udCT0ToQlx8QzCui80ftahf0Mgggg51DFE:cZV/CT0ToYdzLi80VcW
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-