Behavioral task
behavioral1
Sample
646d256d38a61cd4e41c7c3392dc7051725353f996d9eeca990d10c5495b858e.exe
Resource
win7-20230220-en
General
-
Target
0c5f38168a8658fbfc647b0349c3d083.bin
-
Size
20KB
-
MD5
d439ea2e9acfee690d52210a596a23bf
-
SHA1
6c3f00163d17afc74d6a53b0d9952dd6e7206fd0
-
SHA256
29091e77482d190a5202af34ef6a5645215db08db368a143c50e371b70692d3b
-
SHA512
5f2be75c721b8bc215ee64f174cfdccd0d166a5ca6cce96c8d45ccfc2f775e2bdd0b7887ff4bb716e7f6719e48099fda778dedc43a9b4f2945b236daa60048e0
-
SSDEEP
384:3Ne9rVPkjRktDje6gi5gNgp+68pCv460MB1Bw41GnVbn9Rk6QMx9CgMkyjeGSzNb:3NQVP0kgYiy+bCw6V1s9d5ggMkyiGgYc
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
47D5sBnHEh3egzKBj7DbduAvAPeHgnB2p57kKnWLGeY1GwfAZLm2i8ZNiDcenXRXnE9CfdadapECfFuUcdpNaX6pLRH2h8k
1C4hJT5n1tSiGKWup67DAiJdVv6GhjdN7k
bitcoincash:qp7cvk9y54wavs7ymyxs6dg7dsr4jyww3gl7l0u2qu
0x4B2924cc68f9920179ae27423d1b1AFdF1278a16
DMjAHewovYwGUbBRDjLXcBmRF1zdHHixs1
TM5P1JHRL7B6qRLhu1ETn3Fevhjrr4dS8E
LLUBUSsFjwFVyn66kDy5BjumSuQ2Kr76hR
rKGztQSkFyn5wfPg5Bg6JhXKMnRx2pCyDN
t1dmAv1SZBcsbJUpCHN5TEFNUZdGEjTq8o4
Xvm7enX3tAp3Z8xioepTajnCet8FVWMHV7
GC56QYDSZEO3P353Y7FA4YTLGX7YNMQQ7XGZ7O67RTKN7MLGCXCBIEEM
bnb1ydrtrn5fn0ymphv4mc9n2yes6pjhgxnyj5yd7x
2JC8emeKdhgzT8N8m1m6afvAgagAnp8Xpkvcnk6wNKdn
F2J7WG7RTUAEC7JMTB2GNJ2XS3E5UCBBW2R6MBLWUDKINF5ZF7YQ2WBHNA
Signatures
Files
-
0c5f38168a8658fbfc647b0349c3d083.bin.zip
Password: infected
-
646d256d38a61cd4e41c7c3392dc7051725353f996d9eeca990d10c5495b858e.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ