General
-
Target
11dbfb68bfa49df1d9f5089d639dc630e760bbfb16ec3b4c32baee7cec138fcb
-
Size
4.1MB
-
Sample
230131-t63fgsba3t
-
MD5
40278b2bb3b8f79ce2382452ce204d07
-
SHA1
9085644ca84928062071b2ea5db2cddc773cb9fa
-
SHA256
11dbfb68bfa49df1d9f5089d639dc630e760bbfb16ec3b4c32baee7cec138fcb
-
SHA512
4b5363c64acc09176d019142aa95fbaf42d1f807f27f77c43117a3c3c9bdbad61ec564448bf002d2c5ad234068bc190570469fbf1f79923752b5e56feda731c4
-
SSDEEP
98304:Kc0lgzThpRURyzY9KY+mJv0mTjHZari0FPpVBeRxQ1:Kc0WpaAzY9KY+K1TjHZ30dpzck
Static task
static1
Malware Config
Targets
-
-
Target
11dbfb68bfa49df1d9f5089d639dc630e760bbfb16ec3b4c32baee7cec138fcb
-
Size
4.1MB
-
MD5
40278b2bb3b8f79ce2382452ce204d07
-
SHA1
9085644ca84928062071b2ea5db2cddc773cb9fa
-
SHA256
11dbfb68bfa49df1d9f5089d639dc630e760bbfb16ec3b4c32baee7cec138fcb
-
SHA512
4b5363c64acc09176d019142aa95fbaf42d1f807f27f77c43117a3c3c9bdbad61ec564448bf002d2c5ad234068bc190570469fbf1f79923752b5e56feda731c4
-
SSDEEP
98304:Kc0lgzThpRURyzY9KY+mJv0mTjHZari0FPpVBeRxQ1:Kc0WpaAzY9KY+K1TjHZ30dpzck
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-