General
-
Target
b40fe94996a32105ddf5e244a8566e839d1cbfedaf00dc3642c3ce52a9344892
-
Size
4.0MB
-
Sample
230205-2r7ewsee8z
-
MD5
0a6e10b21a07372f0d21a7fa8b41b77c
-
SHA1
14ec6a54e370a718b753de66e3354971cc40dcb7
-
SHA256
b40fe94996a32105ddf5e244a8566e839d1cbfedaf00dc3642c3ce52a9344892
-
SHA512
89d06f549dbb92d81aed160ef0e8182a93743dc9a31bc5d00bb2c2f1f94b5a6b3fe805eaad83f24a00d9d97ce16b77baa1790e0056df9ef2869d12e28ad43c7f
-
SSDEEP
98304:vQXvsLQdrEr11pSS29TFx/J0UZyAop5aQ4OhgqH/743mB/Acl:vqrE3UHfx/aDAofaQT5j43mScl
Static task
static1
Malware Config
Targets
-
-
Target
b40fe94996a32105ddf5e244a8566e839d1cbfedaf00dc3642c3ce52a9344892
-
Size
4.0MB
-
MD5
0a6e10b21a07372f0d21a7fa8b41b77c
-
SHA1
14ec6a54e370a718b753de66e3354971cc40dcb7
-
SHA256
b40fe94996a32105ddf5e244a8566e839d1cbfedaf00dc3642c3ce52a9344892
-
SHA512
89d06f549dbb92d81aed160ef0e8182a93743dc9a31bc5d00bb2c2f1f94b5a6b3fe805eaad83f24a00d9d97ce16b77baa1790e0056df9ef2869d12e28ad43c7f
-
SSDEEP
98304:vQXvsLQdrEr11pSS29TFx/J0UZyAop5aQ4OhgqH/743mB/Acl:vqrE3UHfx/aDAofaQT5j43mScl
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-