General
-
Target
stubdownloader.exe
-
Size
230KB
-
Sample
230525-z6dp1sdb3v
-
MD5
9f78ddf0b80e9d3b735f34c82df45df8
-
SHA1
35412bcc3b08c31baffdaba2aa96a7efea288fa4
-
SHA256
9655ba431831bd59240b44ce2958a0aa20404078da93486cea0b9ce53753a38d
-
SHA512
ae4f08c42c768e7022ea23fbc82abac5412a0dba047f2906c57a8cce8e666ccf6e65007ff1e923a8022e0af3d0070989130b5708ab05d83cae39f72994aa3d5d
-
SSDEEP
3072:KUcvuJEXStOjA7BpQC2mCLsTRozN4rMtH02BhAAH7TNd3XxfyEAg0FujouL1Vwso:omjtOEKKo0MtUEjwEAO3wHes
Static task
static1
Behavioral task
behavioral1
Sample
stubdownloader.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
bitrat
1.38
soon-lp.at.ply.gg:17209
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
C:\ProgramData
-
install_file
Bit
-
tor_process
tor
Targets
-
-
Target
stubdownloader.exe
-
Size
230KB
-
MD5
9f78ddf0b80e9d3b735f34c82df45df8
-
SHA1
35412bcc3b08c31baffdaba2aa96a7efea288fa4
-
SHA256
9655ba431831bd59240b44ce2958a0aa20404078da93486cea0b9ce53753a38d
-
SHA512
ae4f08c42c768e7022ea23fbc82abac5412a0dba047f2906c57a8cce8e666ccf6e65007ff1e923a8022e0af3d0070989130b5708ab05d83cae39f72994aa3d5d
-
SSDEEP
3072:KUcvuJEXStOjA7BpQC2mCLsTRozN4rMtH02BhAAH7TNd3XxfyEAg0FujouL1Vwso:omjtOEKKo0MtUEjwEAO3wHes
Score10/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-