Overview

overview

10

Static

static

10

359f0000.exe

windows7-x64

1

359f0000.exe

windows10-2004-x64

3

35a70000.exe

windows7-x64

1

35a70000.exe

windows10-2004-x64

3

35de0000.exe

windows7-x64

1

35de0000.exe

windows10-2004-x64

3

35e40000.dll

windows7-x64

1

35e40000.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    process_3536.rar

  • Size

    488KB

  • MD5

    0baec3cb63b2fd520c96f7fe4b10afdc

  • SHA1

    d46e80bbcf07b92d868fc6d47f9886b022494d5c

  • SHA256

    bab4d236bd3afde8b68fe7bca1f387ce882c28e69f9d6b51b4547f9230add7ff

  • SHA512

    047eb7915995ea3a2a58d70dc76e8b408a6ffe96c6195b8ed3cfd16746f60a3684bde728810d730e5fb49ca9aa5c432c9daa769c04c8ef66c76ff6fea6e6dd9b

  • SSDEEP

    12288:nfFxnCCN++3iLAkoV1AlO+CooaXDrWM53eLygkyKwKJRMI00c7:nz9NzSAVOlOKsye4Bjc7

Score
10/10

Malware Config

Signatures

  • Nirsoft 3 IoCs
  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • process_3536.rar
    .rar

    Password: infected

  • 359f0000.exe
    .exe windows x86

    Password: infected


    Headers

    Sections

  • 35a70000.exe
    .exe windows x86

    Password: infected


    Headers

    Sections

  • 35de0000.exe
    .exe windows x86

    Password: infected


    Headers

    Sections

  • 35e40000.dll
    .dll windows x86

    Password: infected


    Headers

    Exports

    Sections