General
-
Target
crack1.exe
-
Size
12.7MB
-
Sample
230613-x11w9abc5x
-
MD5
f8e1807b535ba0de2341531d3d1ddfa0
-
SHA1
86a68a4647ac27eaea4cea65b49f2b9aa6edf51f
-
SHA256
3cfb801aec4c94aa04f67808f6f66507b331c6bdaa526f82469ea5960987ab87
-
SHA512
f48154c84f6add19d42aa17e500700884e55d2e5093759a35789f27dd32ca0588010223d21327a210e3bbc016b659da54db4409accd8ec2c4257734e8a9dcd38
-
SSDEEP
393216:nVyPpEyMo//+JXHs79AEF9vVqHPeKSBKMMFlJg3:nVup39//7RJFFVqzfDJg3
Behavioral task
behavioral1
Sample
crack1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
crack1.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
bitrat
1.38
elensias.duckdns.org:0
-
communication_password
56c82ccd658e09e829f16bb99457bcbc
-
install_dir
gnugnu
-
install_file
chorme.exe
-
tor_process
tori
Targets
-
-
Target
crack1.exe
-
Size
12.7MB
-
MD5
f8e1807b535ba0de2341531d3d1ddfa0
-
SHA1
86a68a4647ac27eaea4cea65b49f2b9aa6edf51f
-
SHA256
3cfb801aec4c94aa04f67808f6f66507b331c6bdaa526f82469ea5960987ab87
-
SHA512
f48154c84f6add19d42aa17e500700884e55d2e5093759a35789f27dd32ca0588010223d21327a210e3bbc016b659da54db4409accd8ec2c4257734e8a9dcd38
-
SSDEEP
393216:nVyPpEyMo//+JXHs79AEF9vVqHPeKSBKMMFlJg3:nVup39//7RJFFVqzfDJg3
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-