General
-
Target
b1e22a24ebb0db8b15c9afc6d23679ea.exe
-
Size
23KB
-
Sample
221012-stl3ashce5
-
MD5
b1e22a24ebb0db8b15c9afc6d23679ea
-
SHA1
f65c0f8fd0ac954b116cffbc26ade226269bf738
-
SHA256
413df54020a07f08c1f1155d3a6673354016fc5c2cc000639a5d0f2927818635
-
SHA512
6308da0bfb059c50e2736b325b7ea784a0b26b2a549045cdb2b0aa13e568577f96e23f55be354c770cbb1825c04c12c7c3ee3de9c963b0e1f69d5b32f25b7afb
-
SSDEEP
384:thfPn2EZ4L0yMJLpLgLPLEsLffOSvNTcI1pGIB0PREg:thBZs+tkDEsKqaIB09
Static task
static1
Behavioral task
behavioral1
Sample
b1e22a24ebb0db8b15c9afc6d23679ea.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b1e22a24ebb0db8b15c9afc6d23679ea.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
bitrat
1.38
103.125.190.185:1234
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Targets
-
-
Target
b1e22a24ebb0db8b15c9afc6d23679ea.exe
-
Size
23KB
-
MD5
b1e22a24ebb0db8b15c9afc6d23679ea
-
SHA1
f65c0f8fd0ac954b116cffbc26ade226269bf738
-
SHA256
413df54020a07f08c1f1155d3a6673354016fc5c2cc000639a5d0f2927818635
-
SHA512
6308da0bfb059c50e2736b325b7ea784a0b26b2a549045cdb2b0aa13e568577f96e23f55be354c770cbb1825c04c12c7c3ee3de9c963b0e1f69d5b32f25b7afb
-
SSDEEP
384:thfPn2EZ4L0yMJLpLgLPLEsLffOSvNTcI1pGIB0PREg:thBZs+tkDEsKqaIB09
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-