General
-
Target
PaymentProf.zip
-
Size
7.7MB
-
Sample
230906-qacy6sfe56
-
MD5
ff139aa66d20be99c34f5e9daec7726b
-
SHA1
6f3500c343c7ec13e7ab3b304df735a0b96f29a3
-
SHA256
8af109464910afb8c5dc0e1e3c47c58eb6d44c7cbe1b1c2d0dc2979cf5cb5ea9
-
SHA512
69342842510445e0ba4a7d5279672f71efb73ba61a8087dc28e0b698e3462ed9e21051077aa2e5441cc4a4c6842af937b85a4a4bcd802e96f8b261ef92fc73f6
-
SSDEEP
196608:OzRuAFSr+5tgeTsg+Jlegqf6oxDUX2Wj3JoNzr:OzDFsugkl+SpxD2ZUzr
Static task
static1
Behavioral task
behavioral1
Sample
PaymentProofsigned.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
PaymentProofsigned.exe
Resource
win10v2004-20230831-en
Malware Config
Targets
-
-
Target
PaymentProofsigned.exe
-
Size
8.0MB
-
MD5
302ed52d9459e06cc2d4b81de0e2295c
-
SHA1
73049a2f4f19b01adb05df3c3d073cb6066169e6
-
SHA256
c4c0df629f8dbb15bf56089c1bb1f31e4fcc485376ec771942a997bb1654ee9b
-
SHA512
12fcc7521996f39ea48025e5dc2932901797b537b85e2552b9029c13cfbdd220b2de7291b92907bc1bdb3dcb765f28a56ed338230befeb710ec2521a52c8d0c7
-
SSDEEP
196608:K2stp2jOusPS2pYOUL2SQppEvoLSS167JaOTp:GqO9S2uQ0voLSS16VaOt
Score10/10-
AmmyyAdmin payload
-
Creates new service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-