General
-
Target
4d821c1ae928f982743bced3d3f0820da40f38c860477d17c443f475c52c5e9c
-
Size
4.0MB
-
Sample
221125-fz9z4add87
-
MD5
c886780e2e74c165a969a5729083ab71
-
SHA1
61f45359a78e6007e6738a4741428ee08edf9e5f
-
SHA256
4d821c1ae928f982743bced3d3f0820da40f38c860477d17c443f475c52c5e9c
-
SHA512
ba7d427455549de402c7ae2b70b3ad12f164c52a5d8087b2e5679a313534df3327d9e82464ca2f6c3d78e35193d5f8ec5778acda0ede9d17aa43d01cf179e563
-
SSDEEP
98304:NDn4L4GDxiLGBPqpYflyJpTHDVARYA78RG1Rxx59tVJo+ffQC2cV:Nj4DNiLICgU1HpAiAQ8lftVGaQC2cV
Static task
static1
Malware Config
Targets
-
-
Target
4d821c1ae928f982743bced3d3f0820da40f38c860477d17c443f475c52c5e9c
-
Size
4.0MB
-
MD5
c886780e2e74c165a969a5729083ab71
-
SHA1
61f45359a78e6007e6738a4741428ee08edf9e5f
-
SHA256
4d821c1ae928f982743bced3d3f0820da40f38c860477d17c443f475c52c5e9c
-
SHA512
ba7d427455549de402c7ae2b70b3ad12f164c52a5d8087b2e5679a313534df3327d9e82464ca2f6c3d78e35193d5f8ec5778acda0ede9d17aa43d01cf179e563
-
SSDEEP
98304:NDn4L4GDxiLGBPqpYflyJpTHDVARYA78RG1Rxx59tVJo+ffQC2cV:Nj4DNiLICgU1HpAiAQ8lftVGaQC2cV
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-