Extracted

• • Target

    SecuriteInfo.com.Trojan.PackedNET.2289.22780.12057

  • Size

    805KB

  • MD5

    3973104058c66a17a48710f91ddd1b61

  • SHA1

    2fc05ed15b56c7fe41c018279bdc191ea12418ae

  • SHA256

    54a5be7cfb6c0e4eb1673fc7d158b93094378a55f403afa84b82604bf06a9d5b

  • SHA512

    0dbdf074955e6360a31b3f7a7531b699725013e4dcd116d39c6f26aa3780fe7b44e4cd06560098d8d5539dc91502c77aa1bfff905ae765c103bde6bbd2b4e32c

  • SSDEEP

    12288:SiaGR8FC3MwkHQS3ZGsy++cMGNuGAJboeP0GIMDyO5vzw8xy+zlDhyfjA:ig7kHQwZw++cMGFwfP3Dyacr+zthys

  Score

  10^/10

  persistence

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2