General
-
Target
fe9dec614e6a2047ca5139f76961ab9992efb424dfc2d66dc39334adebd4cdd7
-
Size
4.1MB
-
Sample
230128-jtyawsed86
-
MD5
bc698acf4c63ddb62d6ad98c762266b7
-
SHA1
fc933de1707d3a1bafc05ff016bb40da3e7a2093
-
SHA256
fe9dec614e6a2047ca5139f76961ab9992efb424dfc2d66dc39334adebd4cdd7
-
SHA512
d33e7d597d2b9ebe12e72598b7a83d537e607bd099a385cac5fe502ddc81f93089f71559c352b75e0a549ee175f90c98351a1dc6d5e2b821ea94117cd667f43f
-
SSDEEP
98304:2Dpb+9m8RDbKHP++ZVpbcRkaPx50KXTXa/b0:Sp83S/bcRJIKXTKI
Static task
static1
Malware Config
Targets
-
-
Target
fe9dec614e6a2047ca5139f76961ab9992efb424dfc2d66dc39334adebd4cdd7
-
Size
4.1MB
-
MD5
bc698acf4c63ddb62d6ad98c762266b7
-
SHA1
fc933de1707d3a1bafc05ff016bb40da3e7a2093
-
SHA256
fe9dec614e6a2047ca5139f76961ab9992efb424dfc2d66dc39334adebd4cdd7
-
SHA512
d33e7d597d2b9ebe12e72598b7a83d537e607bd099a385cac5fe502ddc81f93089f71559c352b75e0a549ee175f90c98351a1dc6d5e2b821ea94117cd667f43f
-
SSDEEP
98304:2Dpb+9m8RDbKHP++ZVpbcRkaPx50KXTXa/b0:Sp83S/bcRJIKXTKI
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-