General
-
Target
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a
-
Size
192KB
-
Sample
221022-hh6mfsbcb3
-
MD5
54e5e90fbafdf6f051f2c89da50a4b95
-
SHA1
f1e4459301f216cd4ff0bd27deb9d5a910ef9f5b
-
SHA256
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a
-
SHA512
a22ccbff0ff8da17a8a3a04f38f644b041b47e1c995b8b40b9a7ec4577c850439d244b966834f86d7ce6dd4ec3369ac11d9950429a3336b9b9c53095ea9b0b4b
-
SSDEEP
1536:bB+R6Ywvj1k3w45lEdhKzoUSFeuiS2FIlKbz0PEziNQKjoa:tAwvj1Mw4shKzoUSFeuiS2FIIcwKoa
Static task
static1
Behavioral task
behavioral1
Sample
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
bitrat
1.38
gh9st.mywire.org:5005
-
communication_password
803355ca422bf9b37bc523a750e21842
-
install_dir
svcsvc
-
install_file
svcsvc.exe
-
tor_process
tor
Targets
-
-
Target
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a
-
Size
192KB
-
MD5
54e5e90fbafdf6f051f2c89da50a4b95
-
SHA1
f1e4459301f216cd4ff0bd27deb9d5a910ef9f5b
-
SHA256
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a
-
SHA512
a22ccbff0ff8da17a8a3a04f38f644b041b47e1c995b8b40b9a7ec4577c850439d244b966834f86d7ce6dd4ec3369ac11d9950429a3336b9b9c53095ea9b0b4b
-
SSDEEP
1536:bB+R6Ywvj1k3w45lEdhKzoUSFeuiS2FIlKbz0PEziNQKjoa:tAwvj1Mw4shKzoUSFeuiS2FIIcwKoa
Score10/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-