General
-
Target
RFQ437179.exe.bin
-
Size
1.6MB
-
Sample
230505-zq3n7sed45
-
MD5
86cd58b07940b75f76e5d64f33bb2f9d
-
SHA1
1b052972447a8bcaeccaac9e247db0d47694ac01
-
SHA256
c495bd45af034ec70254209b2bd4d122110382921601efa2c1a9c9dcc83d8343
-
SHA512
cb072ca0634b647937c47a7b88d76bcf87ca02435998c19005d95e2ab777803e3dbd77d401ad2567762b90d49a2fd0ce4844b50f1881de16ec77b9074dd75169
-
SSDEEP
49152:GMd1xCrOtjsfNpiJokPsacWQmASw8c+9CHr:vEOtjIoJoaZQJ78Hg
Static task
static1
Behavioral task
behavioral1
Sample
RFQ437179.exe
Resource
win7-20230220-en
Malware Config
Extracted
darkcloud
https://api.telegram.org/bot5955632087:AAGbHX-YygFpBeOiEaTfH9CY-2MMNrZcY48/sendMessage?chat_id=865011046
Targets
-
-
Target
RFQ437179.exe.bin
-
Size
1.6MB
-
MD5
86cd58b07940b75f76e5d64f33bb2f9d
-
SHA1
1b052972447a8bcaeccaac9e247db0d47694ac01
-
SHA256
c495bd45af034ec70254209b2bd4d122110382921601efa2c1a9c9dcc83d8343
-
SHA512
cb072ca0634b647937c47a7b88d76bcf87ca02435998c19005d95e2ab777803e3dbd77d401ad2567762b90d49a2fd0ce4844b50f1881de16ec77b9074dd75169
-
SSDEEP
49152:GMd1xCrOtjsfNpiJokPsacWQmASw8c+9CHr:vEOtjIoJoaZQJ78Hg
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-