General
-
Target
b7f3bbe2d4281867faafbf082b126334.bin
-
Size
156KB
-
Sample
230225-b15dsabf82
-
MD5
744a248f0ff608c5336ac43acb03e6ee
-
SHA1
4a362a20b0fe38c34cbd3915daac91c024f6968a
-
SHA256
025803b36393bc7b87e759559b17eab350c1a2b6b0951b547a617bef8ce81490
-
SHA512
965667931f1cafd24cfd72317c16848f908dd6ce2e0b13bba41fe40ae8a6b8d3914e8efe86cf79330bb99122668b54b5ccbbbbf5b38b24ada1dff2f957096d51
-
SSDEEP
3072:JQT9Kg4VDzlz62ZKdhYBb0Wu8n28ZOvjfOmdZM2ubQsSqlk8:2T9K1Vg2Zk4bhu8ndyOmY2iSl8
Static task
static1
Behavioral task
behavioral1
Sample
0a5d832f3594465625f855e63075362cf73ef323fc32964e73327aa6a1030584.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0a5d832f3594465625f855e63075362cf73ef323fc32964e73327aa6a1030584.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
0a5d832f3594465625f855e63075362cf73ef323fc32964e73327aa6a1030584.exe
-
Size
312KB
-
MD5
b7f3bbe2d4281867faafbf082b126334
-
SHA1
ffc748cf49fbc9fcd8fb9ba42ffd11839bcb9e4a
-
SHA256
0a5d832f3594465625f855e63075362cf73ef323fc32964e73327aa6a1030584
-
SHA512
3aa22851b4ded467b8bf8c830afa16fe9b55f5655d429b67d42ec50fab3e88898489670329cb36c5b859dd3767809fdf976a152900832ba3bd67ed50aeb966a3
-
SSDEEP
6144:E4PWLN3m+XeeqeO0UQeQ8KbLVHqAQg5jIQsfEPn:6aeqeO0UQB8KFHqAYfEPn
Score10/10-
Detects PseudoManuscrypt payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
PseudoManuscrypt
PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-