General
-
Target
SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe
-
Size
3.8MB
-
Sample
230315-f5eq5sdf7x
-
MD5
d07b7112b39c9eee7eaeba1adb099543
-
SHA1
1df70cc161540228240e1dde290ac2f5efcfbb0c
-
SHA256
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
-
SHA512
9f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
SSDEEP
98304:cCtEONaf1kMdpRfZJDRJwdaUNa8gPgEICG6x098gJ2uCB9Ml:RE0UkkHRJuNawLCG6x+8gJFm
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe
Resource
win7-20230220-en
Malware Config
Extracted
bitrat
1.38
74.201.28.92:3569
-
communication_password
148b191cf4e80b549e1b1a4444f2bdf6
-
tor_process
tor
Targets
-
-
Target
SecuriteInfo.com.Trojan.Siggen20.5502.44.30386.exe
-
Size
3.8MB
-
MD5
d07b7112b39c9eee7eaeba1adb099543
-
SHA1
1df70cc161540228240e1dde290ac2f5efcfbb0c
-
SHA256
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
-
SHA512
9f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
SSDEEP
98304:cCtEONaf1kMdpRfZJDRJwdaUNa8gPgEICG6x098gJ2uCB9Ml:RE0UkkHRJuNawLCG6x+8gJFm
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-