General
-
Target
abeab66727fb55fff95223a8570eecc6b43525cea762090d7368220c345f2c24
-
Size
266KB
-
Sample
221124-epk3jsbd2z
-
MD5
157bcc54ed4ed8f4c4ad49e0669e0bbf
-
SHA1
090e1b1503f796178707504077f2ee42c11bb7b2
-
SHA256
abeab66727fb55fff95223a8570eecc6b43525cea762090d7368220c345f2c24
-
SHA512
45000639b867356e5c2c7271e104e99fe7dca40b7cb67b9fa9476f374fe0369f23700dc55dbe12022fa7c10cde50bdfe3239db3443482fd5acc9818c45353629
-
SSDEEP
6144:9DMDnHLmmBAyIEIqOLjsoiCm2cGuZaz/Bi55mwTnc:9D6nKmBHIEIqEvk75i/Bc5T7c
Static task
static1
Behavioral task
behavioral1
Sample
abeab66727fb55fff95223a8570eecc6b43525cea762090d7368220c345f2c24.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
abeab66727fb55fff95223a8570eecc6b43525cea762090d7368220c345f2c24.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-3385717845-2518323428-350143044-1000\HELP_RECOVER_instructions+fbw.txt
http://pren874bwsdbmbwe.returnyourfiless.ru/6B68AFA04D8B3336
http://i4sdmjn4fsdsdqfhu12l.orbyscabz.com/6B68AFA04D8B3336
http://rr48nfhdj5wedsm99324.tuttianent.at/6B68AFA04D8B3336
http://yez2o5lwqkmlv5lc.onion/6B68AFA04D8B3336
Targets
-
-
Target
abeab66727fb55fff95223a8570eecc6b43525cea762090d7368220c345f2c24
-
Size
266KB
-
MD5
157bcc54ed4ed8f4c4ad49e0669e0bbf
-
SHA1
090e1b1503f796178707504077f2ee42c11bb7b2
-
SHA256
abeab66727fb55fff95223a8570eecc6b43525cea762090d7368220c345f2c24
-
SHA512
45000639b867356e5c2c7271e104e99fe7dca40b7cb67b9fa9476f374fe0369f23700dc55dbe12022fa7c10cde50bdfe3239db3443482fd5acc9818c45353629
-
SSDEEP
6144:9DMDnHLmmBAyIEIqOLjsoiCm2cGuZaz/Bi55mwTnc:9D6nKmBHIEIqEvk75i/Bc5T7c
Score10/10-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-