Resubmissions
17-08-2023 05:42
230817-gd99eafd82 10General
-
Target
2023-03-31.zip
-
Size
195.7MB
-
Sample
230817-gd99eafd82
-
MD5
79d6e199a0633af6b40ddc3beb286d42
-
SHA1
78478d850bb087d417d2e4e59f36f0041f5f4ffa
-
SHA256
dd54a92b38dfab67e6832962c6aef8a4272bf7989c97a554f438dd0e92f34b1f
-
SHA512
63adb14045d5f4c527c687662252ba535fe76fdbdb567ddec96ba85d0b48ea771c8cc1cce7cfea62f6f72d49c6da8747e14de21faba07bb715ef7cf37dfa0fda
-
SSDEEP
6291456:kITrRt5tiZLXrBTe1QTzYLtvB2t4fQfLK49:tfRn0lXBe1KgtvB2tAUuE
Static task
static1
Behavioral task
behavioral1
Sample
2023-03-31.zip
Resource
win10v2004-20230703-en
Malware Config
Extracted
mirai
WICKED
Extracted
mirai
bruh123.hopto.org
Extracted
njrat
im523
stray
eur-mambo.at.ply.gg:21834
3f3b32067a957367c286d896ac802270
-
reg_key
3f3b32067a957367c286d896ac802270
-
splitter
|'|'|
Extracted
mirai
WICKED
Extracted
mirai
WICKED
Extracted
mirai
LZRD
Extracted
amadey
3.69
193.233.20.29/games/category/index.php
Extracted
socelars
https://hdbywe.s3.us-west-2.amazonaws.com/dfgg320/
Extracted
asyncrat
AsyncRAT
New
websites.vpndns.net:112
AsyncMutex_5552
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Extracted
mirai
LZRD
Extracted
mirai
bruh123.hopto.org
Extracted
gafgyt
5.249.162.136:4258
161.35.25.184:9034
Extracted
njrat
0.7d
HacKed
cisco5319.ddns.net:1177
22d454c9d4a86e192f7a5423970a5c83
-
reg_key
22d454c9d4a86e192f7a5423970a5c83
-
splitter
|'|'|
Extracted
njrat
0.7d
CrossFire
audiodgx.hopto.org:5552
19cb0d51f6ccd969c2d64e6b68b1fc01
-
reg_key
19cb0d51f6ccd969c2d64e6b68b1fc01
-
splitter
|'|'|
Extracted
mirai
bruh123.hopto.org
Extracted
mirai
BOTNET
Extracted
njrat
v2.0
HacKed
study-silly.at.ply.gg:42876
Windows
-
reg_key
Windows
-
splitter
|-F-|
Extracted
purecrypter
http://192.3.215.60/uo7/Zkbscbhcbcv.png
Extracted
mirai
WICKED
Extracted
mirai
LZRD
Extracted
mirai
bruh123.hopto.org
Extracted
mirai
WICKED
Extracted
mirai
WICKED
Targets
-
-
Target
2023-03-31.zip
-
Size
195.7MB
-
MD5
79d6e199a0633af6b40ddc3beb286d42
-
SHA1
78478d850bb087d417d2e4e59f36f0041f5f4ffa
-
SHA256
dd54a92b38dfab67e6832962c6aef8a4272bf7989c97a554f438dd0e92f34b1f
-
SHA512
63adb14045d5f4c527c687662252ba535fe76fdbdb567ddec96ba85d0b48ea771c8cc1cce7cfea62f6f72d49c6da8747e14de21faba07bb715ef7cf37dfa0fda
-
SSDEEP
6291456:kITrRt5tiZLXrBTe1QTzYLtvB2t4fQfLK49:tfRn0lXBe1KgtvB2tAUuE
Score6/10-
Process spawned suspicious child process
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
-