General
-
Target
8786b658cc8531383511362b788f8f1c.bin
-
Size
374KB
-
Sample
230309-bxjynsaa54
-
MD5
6e6293c62717a4b3a32339131a137216
-
SHA1
9cac56e87f9032b83ee4ec42c2f477dabb22cc27
-
SHA256
8f136de62431644377a9d55563721cf4bb2b99d5942c2ccc272a28a4eac318c7
-
SHA512
bf044d64ea959d46ac1c930096aeec84bf5218e2130f4d20a3327db1f1a51c5f55e19397d8a25739c62f429a51aa64fc6f80e0c78e89120fd23611cd5f962c7d
-
SSDEEP
6144:hHmlzozVYiJqC9PoBGioyaoS0ysGXBW3PgF/G3Omi6RU0040heGlV8v4SmQyoxIc:xm+zH59+XS0ysoBdAO16RU0rGE4TNox/
Static task
static1
Behavioral task
behavioral1
Sample
ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe
Resource
win7-20230220-en
Malware Config
Extracted
socelars
https://hdbywe.s3.us-west-2.amazonaws.com/sadef33/
Extracted
gcleaner
45.12.253.56
45.12.253.72
45.12.253.98
45.12.253.75
Targets
-
-
Target
ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe
-
Size
396KB
-
MD5
8786b658cc8531383511362b788f8f1c
-
SHA1
58da30ee843e7d5f51bdacca1ea495b84a7678fd
-
SHA256
ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059
-
SHA512
d99b28db09067135359de87244a56d039399591d29c0bcf8c7d2163f934a938c4248239d87fcb6e99b9f0bce7132e95d0581ae32e73603af489f8b1444a44f5f
-
SSDEEP
12288:iQi3Qa6m6URA3PhNOZm2K7YOY5p2tpNnnTIg:iQiA5hhVFf4y3Tp
-
Detects PseudoManuscrypt payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
PseudoManuscrypt
PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.
-
Socelars payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks for common network interception software
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-