6413b835503a6c77f347a262f0ce18de15ea59608658aa8c2e51a3433ffe1624

Resubmissions

15-01-2023 00:36

15-01-2023 00:11

15-01-2023 00:06

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2023 00:06

Target

interium/settings/Golyb0u_No_Psalo/legitbot.ini
Size

21KB
MD5

756d1f4adf27bde7dc09b90853cd0b79
SHA1

60ee856117ea86da73315d05c7cdfda583cfe993
SHA256

87c23c780154b3bfb39183579590564d9bc1dba048ea47f3511a1042e5aad04a
SHA512

0e61d18dd4422a4b468eedfc68c8f711995b34e731c8e1aeb9352a2d59edcb03f305ada6683539d9ca4eef827a9f1aed6aa75f3eec1efba645ab84428f47d1b0
SSDEEP

384:e2J9ouT4yaVtzdLIADQnZSBc6F1jeXhyaXzX6XbXXX4XEX6XhXSXyf+iwocudqD4:1ouTTItzdLpDQnZSBc6F1jeXhyaXzX6y

Score

1^/10

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4828	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\interium\settings\Golyb0u_No_Psalo\legitbot.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:4828