General
-
Target
fed498d248c7e1873131dacba6a7c5466f2ec2aacfa5bc24bfc1e2d70aac7631
-
Size
4.0MB
-
Sample
230204-fshbhacf39
-
MD5
430e78bfaabc27f457f40b0c72e3753b
-
SHA1
e5cd0dcf77742ac3085af2b667f7b19388d98337
-
SHA256
fed498d248c7e1873131dacba6a7c5466f2ec2aacfa5bc24bfc1e2d70aac7631
-
SHA512
75f58db9cab44f6409326e8878ed840862f12ca7c35ec3f58be9752efff276e0fe0d7819bca31ac2847f248e470ab63ec5a65447100d11dd49dec475064ec0fd
-
SSDEEP
98304:ayKj4/EuyB7vnyJSeAt6ga7W5IRytB1FhU18:8j0ByB7vnyJSXa7MtB1F
Static task
static1
Malware Config
Targets
-
-
Target
fed498d248c7e1873131dacba6a7c5466f2ec2aacfa5bc24bfc1e2d70aac7631
-
Size
4.0MB
-
MD5
430e78bfaabc27f457f40b0c72e3753b
-
SHA1
e5cd0dcf77742ac3085af2b667f7b19388d98337
-
SHA256
fed498d248c7e1873131dacba6a7c5466f2ec2aacfa5bc24bfc1e2d70aac7631
-
SHA512
75f58db9cab44f6409326e8878ed840862f12ca7c35ec3f58be9752efff276e0fe0d7819bca31ac2847f248e470ab63ec5a65447100d11dd49dec475064ec0fd
-
SSDEEP
98304:ayKj4/EuyB7vnyJSeAt6ga7W5IRytB1FhU18:8j0ByB7vnyJSXa7MtB1F
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-