General
-
Target
b61f291f8844d721033c1e359c860ef80caa23eb5a121cc94582ac53c36a5635
-
Size
3MB
-
Sample
230202-vh77haed9s
-
MD5
4740c5f86b9a4f7ba47a78c8be2da6f2
-
SHA1
85df691198d3f7814bf8c0362e1464ae6d8ad620
-
SHA256
b61f291f8844d721033c1e359c860ef80caa23eb5a121cc94582ac53c36a5635
-
SHA512
09e44569adb27e597bf99dca20ebe477a713a5fcbdb8cab827802b45b1c47baf54cc073581d91f7aad74b78eff28b597216a7da8170b305bfd86eac78c9e7c50
-
SSDEEP
98304:TorSjpqCjRWs+aS/uZR88eK2ShU0NCUFSNTEaxJepw5ZV/iBQ10:TfjphtWs+aS/udeLShU0VYTqqxi1
Static task
static1
Malware Config
Targets
-
-
Target
b61f291f8844d721033c1e359c860ef80caa23eb5a121cc94582ac53c36a5635
-
Size
3MB
-
MD5
4740c5f86b9a4f7ba47a78c8be2da6f2
-
SHA1
85df691198d3f7814bf8c0362e1464ae6d8ad620
-
SHA256
b61f291f8844d721033c1e359c860ef80caa23eb5a121cc94582ac53c36a5635
-
SHA512
09e44569adb27e597bf99dca20ebe477a713a5fcbdb8cab827802b45b1c47baf54cc073581d91f7aad74b78eff28b597216a7da8170b305bfd86eac78c9e7c50
-
SSDEEP
98304:TorSjpqCjRWs+aS/uZR88eK2ShU0NCUFSNTEaxJepw5ZV/iBQ10:TfjphtWs+aS/udeLShU0VYTqqxi1
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-