General
-
Target
proxy.txt
-
Size
491KB
-
Sample
230311-1jlmsabd46
-
MD5
2cd54c149b6b96b1c52c36982b6545b9
-
SHA1
c39a3b7b55dfb66abb02999f64cae3d8f9db7a83
-
SHA256
c22543e8c5c5dcdc21b7f410526f9dbec9de61c7ce3a2f24087c7ccfbbfdf65a
-
SHA512
9e7611d9c8c0137d17374cdffe74a22deeeff057dc110555df67dfc98d0f3b6509cdbc39d87ce5159f9e8de98c7d47b100a97ab06598d828dedf526114d4ac44
-
SSDEEP
3072:eHIJE87YlnkAgSbavgiQzrRyTbooKj4HSxaocRGDiOCRgk4:EVvevgtztWK8SxrRD+gd
Static task
static1
Malware Config
Targets
-
-
Target
proxy.txt
-
Size
491KB
-
MD5
2cd54c149b6b96b1c52c36982b6545b9
-
SHA1
c39a3b7b55dfb66abb02999f64cae3d8f9db7a83
-
SHA256
c22543e8c5c5dcdc21b7f410526f9dbec9de61c7ce3a2f24087c7ccfbbfdf65a
-
SHA512
9e7611d9c8c0137d17374cdffe74a22deeeff057dc110555df67dfc98d0f3b6509cdbc39d87ce5159f9e8de98c7d47b100a97ab06598d828dedf526114d4ac44
-
SSDEEP
3072:eHIJE87YlnkAgSbavgiQzrRyTbooKj4HSxaocRGDiOCRgk4:EVvevgtztWK8SxrRD+gd
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-