General
-
Target
v.exe
-
Size
21.2MB
-
Sample
230824-mle15abh36
-
MD5
e9f7458b57acc01d8f6341c08f7bf3cb
-
SHA1
051983ffe44b4d9c10b96540669a1cbd90beddf5
-
SHA256
d7bc3c559f864073807734d042eb5d522dc424026bfe2772380e2317dd22b7d3
-
SHA512
11770597852545ae80cb8bc1614a8aec96564f8bcec09fabb54a5bfadafd4372f641e4651d995542b466558a79ec0d173ec9a3fef0e7ed79f5fdddf2529a3e4d
-
SSDEEP
393216:NDna3FQtsf6r7M5livQETSWvJQn9OqI26YlgzdCyddk:N21Qtsf87M5lmQEWWhQoWOr
Behavioral task
behavioral1
Sample
v.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
v.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
VAC-BYPASS.pyc
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
VAC-BYPASS.pyc
Resource
win10v2004-20230703-en
Malware Config
Targets
-
-
Target
v.exe
-
Size
21.2MB
-
MD5
e9f7458b57acc01d8f6341c08f7bf3cb
-
SHA1
051983ffe44b4d9c10b96540669a1cbd90beddf5
-
SHA256
d7bc3c559f864073807734d042eb5d522dc424026bfe2772380e2317dd22b7d3
-
SHA512
11770597852545ae80cb8bc1614a8aec96564f8bcec09fabb54a5bfadafd4372f641e4651d995542b466558a79ec0d173ec9a3fef0e7ed79f5fdddf2529a3e4d
-
SSDEEP
393216:NDna3FQtsf6r7M5livQETSWvJQn9OqI26YlgzdCyddk:N21Qtsf87M5lmQEWWhQoWOr
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
VAC-BYPASS.pyc
-
Size
49KB
-
MD5
25dc5a591c5b120ac755f13295c04fdf
-
SHA1
9ba08ff5b9c8b255260d5508499837402fe6edd8
-
SHA256
44f2f2a3bc2e21c5c5b0ab16cc014a37faf71d9fc1ed3526f2f1d719f3a254bb
-
SHA512
e94cf6ef42adb3d156df5f816ac814116b852d2748fca6a3946cf480dfd14ad218098271c1b85dbac2914f4e2bcfc077325fe748c094cffe606aa2bdc0f1689b
-
SSDEEP
1536:t9MWn/28/r+5vipuMqK8GRY4GKT10+SffloRvJPODlhLxmUSgeC:pHiUpu7K8iY4GKT1sloRvJP5UaC
Score3/10 -