General
-
Target
06721899.exe
-
Size
2.1MB
-
Sample
230531-wcnrcagh3t
-
MD5
63e1c29b4c151caf92970fbaf8e0c2a7
-
SHA1
896386e7fd8d86ab3819598f4a549e61b919eee4
-
SHA256
719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
-
SHA512
246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
SSDEEP
49152:GCO1NlTK6quyJYbwyi0UZTdA71QxlJOJ56eJwzG6hCF98v7:GJATVdA7WtOOeiv7
Static task
static1
Behavioral task
behavioral1
Sample
06721899.exe
Resource
win7-20230220-en
Malware Config
Extracted
bitrat
1.38
bitratluckshinjisix130.freeddns.org:7011
-
communication_password
71042e216840c2f1d480e868f387e8db
-
tor_process
tor
Targets
-
-
Target
06721899.exe
-
Size
2.1MB
-
MD5
63e1c29b4c151caf92970fbaf8e0c2a7
-
SHA1
896386e7fd8d86ab3819598f4a549e61b919eee4
-
SHA256
719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
-
SHA512
246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
SSDEEP
49152:GCO1NlTK6quyJYbwyi0UZTdA71QxlJOJ56eJwzG6hCF98v7:GJATVdA7WtOOeiv7
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-