General
-
Target
d821a78d94ff4dd593074f2694ca8775c90eda22fc843fb7883d6c8f1971c571
-
Size
542KB
-
Sample
221124-cnfekaec3v
-
MD5
ec0c19ddbb83f0f66e5b8a1dac19d600
-
SHA1
a65a6c285c16481b69c4beb0a0f18ee8d4ef1410
-
SHA256
d821a78d94ff4dd593074f2694ca8775c90eda22fc843fb7883d6c8f1971c571
-
SHA512
48e0b114931c49dbce9cc90c4f4c29c64ad9890633f8ad97177418a602fe1b61b49f8bd7c2c2f81fb09ad3432c044981cdc4eacd7829aaae13090d39cfa51e87
-
SSDEEP
12288:9B8fdm0caw0mnTsF2ruFbKE48qEiSgemF6Tsl+hzNq7pCEZB/rlgH1PNf:9B8fQ1azQgj9KIq5SgJj0NN8CEnGn
Static task
static1
Behavioral task
behavioral1
Sample
d821a78d94ff4dd593074f2694ca8775c90eda22fc843fb7883d6c8f1971c571.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d821a78d94ff4dd593074f2694ca8775c90eda22fc843fb7883d6c8f1971c571.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
d821a78d94ff4dd593074f2694ca8775c90eda22fc843fb7883d6c8f1971c571
-
Size
542KB
-
MD5
ec0c19ddbb83f0f66e5b8a1dac19d600
-
SHA1
a65a6c285c16481b69c4beb0a0f18ee8d4ef1410
-
SHA256
d821a78d94ff4dd593074f2694ca8775c90eda22fc843fb7883d6c8f1971c571
-
SHA512
48e0b114931c49dbce9cc90c4f4c29c64ad9890633f8ad97177418a602fe1b61b49f8bd7c2c2f81fb09ad3432c044981cdc4eacd7829aaae13090d39cfa51e87
-
SSDEEP
12288:9B8fdm0caw0mnTsF2ruFbKE48qEiSgemF6Tsl+hzNq7pCEZB/rlgH1PNf:9B8fQ1azQgj9KIq5SgJj0NN8CEnGn
-
Modifies WinLogon for persistence
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-