General
-
Target
92d8874c9bccf6efe5794d190c6f0aae.bin
-
Size
401KB
-
Sample
230206-lpb8zadc45
-
MD5
4eef5c3c5a5502caa1d27cee5640c215
-
SHA1
1a6e95bb5b6a00a7c204aaf73d8323cd939652f4
-
SHA256
070376078ab0b6c5310ebb69e7a1eec11626113f46101e87e482b3bdf2e8e7ca
-
SHA512
077d8e9b40e01753dd022126c2e8a7b39a986db831beda0658941537cd71375cc1361e0843f10e726fe755ca3f8ff2335bea310a69d49cf6c416fa46c6d69d09
-
SSDEEP
12288:TblFziLIeDxB3khD12oCgBv6GesAy8YaVAplAGfOaMLm:rz7ev0hoYNesQnVApNfLf
Static task
static1
Behavioral task
behavioral1
Sample
8bb65de7a3ac7c7cdf84ff44b3e09ea54ed7e38dde63a886b4c04321dcfe2402.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8bb65de7a3ac7c7cdf84ff44b3e09ea54ed7e38dde63a886b4c04321dcfe2402.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Targets
-
-
Target
8bb65de7a3ac7c7cdf84ff44b3e09ea54ed7e38dde63a886b4c04321dcfe2402.exe
-
Size
758KB
-
MD5
92d8874c9bccf6efe5794d190c6f0aae
-
SHA1
644a860909f12dde66cdc9e6e1fb574f5114a106
-
SHA256
8bb65de7a3ac7c7cdf84ff44b3e09ea54ed7e38dde63a886b4c04321dcfe2402
-
SHA512
200c9271e2268e8231c2c64c6f418aba06eacecfc58376741e14415f1dafe45b204deb76fb411702189a4f57c25c0689453aaca664c819ddc3346d71c1b09f36
-
SSDEEP
12288:VQi3pRnv6m6URA3Phfgp1hf39Wkv8xwJiWt6uIn:VQiZZChh4pdUMic6uY
-
Detect rhadamanthys stealer shellcode
-
Detects LgoogLoader payload
-
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-