General
-
Target
4de21bc0e12f92ae5eb308fc2e30bb5f.bin
-
Size
6.5MB
-
Sample
230731-b2rt3sca97
-
MD5
4de21bc0e12f92ae5eb308fc2e30bb5f
-
SHA1
f462e64fcd864a582c3e101971461490c3cc7b8a
-
SHA256
48ddd61158c760a454014c393fa060628fa8d2a36597164f0a5cedb9aca1e013
-
SHA512
c7c7cb00f73965dc0e4921a94153dee4dff89b8fbe39d5bbde712705a98eea92271eb21e16f11a5bc75b4f28cb5a16701a6d949fd250de738e165563994b7ba3
-
SSDEEP
196608:5qUZ/P/pRnYOfD73s15PpmXgagoDvs4faJCD0RWz1Uq6z:3vHH8Qgfo7sWOCr19K
Malware Config
Targets
-
-
Target
svchost.bin
-
Size
6.6MB
-
MD5
2787bb2d1ab223f8ac2692f3a8fd85fc
-
SHA1
dc34ee4e46ddea333cdc90e4aad7589cb8ee1ea0
-
SHA256
952e3e059251cd41e3c67006c5aa4b75fe3e6b0f18d96554b2d60d4ccfb78cb4
-
SHA512
d79bd7599ccb09fa72b939a506d04e28cb958e59c3987ab4d375e76337d5b1e33369d59397338aaeaf938c14ec9d93b20501d5224d151631c69c874d0657e9f3
-
SSDEEP
196608:eAqjTpnhXlmyWCZNulPKQ8hY/Bkr/fOIT/+VdlBFKazU:kfauN/HYOSIT/EVF9I
Score10/10-
Beapy
Beapy is a python worm with crypto mining capabilities.
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Contacts a large (6122) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Contacts a large (8002) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
mimikatz is an open source tool to dump credentials on Windows
-
Modifies Windows Firewall
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-