General
-
Target
cc6bf75b9b4c9bba7fd02ad6a780b4b2d6ee00e2a2ec958ecfbe947120f56775
-
Size
452KB
-
Sample
221128-m2xwwaha93
-
MD5
1201b993a35128d6d54dc93814c5c991
-
SHA1
9b4ac00682f268f1d44061d3fb71bf8fef237976
-
SHA256
cc6bf75b9b4c9bba7fd02ad6a780b4b2d6ee00e2a2ec958ecfbe947120f56775
-
SHA512
3a71e60dadc470291586318bb91ae041c61baad80d432169291cdf6bd8f788ce54c3d3869b38a0a8bbea13c900fc34e10d640927cc8612bce6c78b3af68d86f0
-
SSDEEP
12288:JVk7AfGHezuQDdEuqRIPFabGHc/fZ7gTMsxm8sRb9TO:JVcazuQDdnqoaCuf/s4ZRx
Static task
static1
Behavioral task
behavioral1
Sample
cc6bf75b9b4c9bba7fd02ad6a780b4b2d6ee00e2a2ec958ecfbe947120f56775.exe
Resource
win7-20221111-en
Malware Config
Targets
-
-
Target
cc6bf75b9b4c9bba7fd02ad6a780b4b2d6ee00e2a2ec958ecfbe947120f56775
-
Size
452KB
-
MD5
1201b993a35128d6d54dc93814c5c991
-
SHA1
9b4ac00682f268f1d44061d3fb71bf8fef237976
-
SHA256
cc6bf75b9b4c9bba7fd02ad6a780b4b2d6ee00e2a2ec958ecfbe947120f56775
-
SHA512
3a71e60dadc470291586318bb91ae041c61baad80d432169291cdf6bd8f788ce54c3d3869b38a0a8bbea13c900fc34e10d640927cc8612bce6c78b3af68d86f0
-
SSDEEP
12288:JVk7AfGHezuQDdEuqRIPFabGHc/fZ7gTMsxm8sRb9TO:JVcazuQDdnqoaCuf/s4ZRx
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-