General
-
Target
https://dealerinfo.com/evo2/fresh/eLead-V45/elead_track/Weblink/whitedot.aspx?eqsv2=UzuYDumqQj06GEEAJu9LTBOBCX1A0Jxr6sv4eKualYOtVmmG5TrNZ6tvhNfg9tdCNlgOsvxcveXFLt7RZeHtWAzyUkTTf8uO%2fm%2fg2Zt8cAzRzH5t%2bTMJtm6Jov2I5loP9bEIXx0E%2fdA0ZMlqArKdD7fZRysKU256sC%2bxVnGkjyT2YAdPDDg9UBLBf9s%2fPhy6X0VZok%2b%2fvM1HCkOy%2bByeRzfLYjnIo2m%2bldaCSvDvlfLdH7cTkuSqnz3aXb9UdXpnAYqEdNBZUIQ9NGOzd0C%2bgbqgbfZQaPVwHh3URwEKmxg%3d
-
Sample
230214-q9t2qsdc4w
Malware Config
Targets
-
-
Target
https://dealerinfo.com/evo2/fresh/eLead-V45/elead_track/Weblink/whitedot.aspx?eqsv2=UzuYDumqQj06GEEAJu9LTBOBCX1A0Jxr6sv4eKualYOtVmmG5TrNZ6tvhNfg9tdCNlgOsvxcveXFLt7RZeHtWAzyUkTTf8uO%2fm%2fg2Zt8cAzRzH5t%2bTMJtm6Jov2I5loP9bEIXx0E%2fdA0ZMlqArKdD7fZRysKU256sC%2bxVnGkjyT2YAdPDDg9UBLBf9s%2fPhy6X0VZok%2b%2fvM1HCkOy%2bByeRzfLYjnIo2m%2bldaCSvDvlfLdH7cTkuSqnz3aXb9UdXpnAYqEdNBZUIQ9NGOzd0C%2bgbqgbfZQaPVwHh3URwEKmxg%3d
Score7/10-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-