General
-
Target
fc87f79da45a9ffcf0a3284798c6d491d009372d5b3782dbdd6fd7f8be01a327
-
Size
780KB
-
Sample
221130-xremnaff35
-
MD5
43153f4f79278075981dbb98b580d74f
-
SHA1
2455e4217cb8fbd4ebfaa16330558dc128adda1e
-
SHA256
fc87f79da45a9ffcf0a3284798c6d491d009372d5b3782dbdd6fd7f8be01a327
-
SHA512
be2018eaf2a61211d85734faf0927f39486965d4cdce24e72ad81f2d0a9c82ea04c7753d16bd92b65a5ea92b4f0b54f43ab18e24f8c55b8a269d582c025af123
-
SSDEEP
24576:wR/SQVi7i3JFLMEhQQDhoDl4uInnotriI:ci7qLjGmoDlV2g+I
Static task
static1
Behavioral task
behavioral1
Sample
fc87f79da45a9ffcf0a3284798c6d491d009372d5b3782dbdd6fd7f8be01a327.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fc87f79da45a9ffcf0a3284798c6d491d009372d5b3782dbdd6fd7f8be01a327.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.vivaldi.net - Port:
587 - Username:
smithdean@vivaldi.net - Password:
25194e1936feD$
Targets
-
-
Target
fc87f79da45a9ffcf0a3284798c6d491d009372d5b3782dbdd6fd7f8be01a327
-
Size
780KB
-
MD5
43153f4f79278075981dbb98b580d74f
-
SHA1
2455e4217cb8fbd4ebfaa16330558dc128adda1e
-
SHA256
fc87f79da45a9ffcf0a3284798c6d491d009372d5b3782dbdd6fd7f8be01a327
-
SHA512
be2018eaf2a61211d85734faf0927f39486965d4cdce24e72ad81f2d0a9c82ea04c7753d16bd92b65a5ea92b4f0b54f43ab18e24f8c55b8a269d582c025af123
-
SSDEEP
24576:wR/SQVi7i3JFLMEhQQDhoDl4uInnotriI:ci7qLjGmoDlV2g+I
-
Beds Protector Packer
Detects Beds Protector packer used to load .NET malware.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-