General
-
Target
a4994a660e71a5ce39759c19df0457a35fbd06dd97e7743176a41948530ae8a8
-
Size
4.0MB
-
Sample
221129-mg2dkaae47
-
MD5
cc0bbe565f01115460d6c7c4ea97a713
-
SHA1
bc613ab51b59c64f2cc0102af555b059e3e8dc44
-
SHA256
a4994a660e71a5ce39759c19df0457a35fbd06dd97e7743176a41948530ae8a8
-
SHA512
3171f85b222ee3cb03308b7bd9f3016a5c6cf40a6398800bdaac373563d58924a9c7b16ca38af9c204ebd3fc4f955744a2afcddee69a792db812dc7fdb54df9d
-
SSDEEP
98304:hciIpCigwRl+b9aIT4AqJugDCkZANiPaRxJhacm:hcidiLTIT4ATgDlZAoaz6cm
Static task
static1
Malware Config
Targets
-
-
Target
a4994a660e71a5ce39759c19df0457a35fbd06dd97e7743176a41948530ae8a8
-
Size
4.0MB
-
MD5
cc0bbe565f01115460d6c7c4ea97a713
-
SHA1
bc613ab51b59c64f2cc0102af555b059e3e8dc44
-
SHA256
a4994a660e71a5ce39759c19df0457a35fbd06dd97e7743176a41948530ae8a8
-
SHA512
3171f85b222ee3cb03308b7bd9f3016a5c6cf40a6398800bdaac373563d58924a9c7b16ca38af9c204ebd3fc4f955744a2afcddee69a792db812dc7fdb54df9d
-
SSDEEP
98304:hciIpCigwRl+b9aIT4AqJugDCkZANiPaRxJhacm:hcidiLTIT4ATgDlZAoaz6cm
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-