General
-
Target
d0e08f801b4aba9de8523183472530d713201c169921600935de927fb7f46ce1
-
Size
452KB
-
Sample
221127-rv4s3ahf6w
-
MD5
64f18c1e268b738feeb180ed9b26736d
-
SHA1
d5fc79155c649bb278590112a0448cda345339be
-
SHA256
d0e08f801b4aba9de8523183472530d713201c169921600935de927fb7f46ce1
-
SHA512
42b0c48c146f0cf996011e696a3464e5a3da66278e4ba7d29ac2424433ac67c55a8e618a4204b478921702be7414a4434d36d7264d93746ded86c1f0b0d84ff0
-
SSDEEP
12288:R/H+31WFNsE5n4aftCCnPdJkttdELMfvF5mIO:R/H+0n5nPVCw3kXwMXF5mf
Static task
static1
Behavioral task
behavioral1
Sample
d0e08f801b4aba9de8523183472530d713201c169921600935de927fb7f46ce1.exe
Resource
win7-20221111-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.ru - Port:
587 - Username:
[email protected] - Password:
ablegod123456789
Targets
-
-
Target
d0e08f801b4aba9de8523183472530d713201c169921600935de927fb7f46ce1
-
Size
452KB
-
MD5
64f18c1e268b738feeb180ed9b26736d
-
SHA1
d5fc79155c649bb278590112a0448cda345339be
-
SHA256
d0e08f801b4aba9de8523183472530d713201c169921600935de927fb7f46ce1
-
SHA512
42b0c48c146f0cf996011e696a3464e5a3da66278e4ba7d29ac2424433ac67c55a8e618a4204b478921702be7414a4434d36d7264d93746ded86c1f0b0d84ff0
-
SSDEEP
12288:R/H+31WFNsE5n4aftCCnPdJkttdELMfvF5mIO:R/H+0n5nPVCw3kXwMXF5mf
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-