Overview

overview

10

Static

static

10

a3c341fdee...8c.dll

windows7-x64

1

a3c341fdee...8c.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01347dd4214ef8ce566216467f2c8047.bin

  • Size

    4.3MB

  • MD5

    8defb1f0d34ae61a3803f8fe0915db12

  • SHA1

    23aa1c0fb002b7cc8a3eb4a461741ace6de58964

  • SHA256

    75477f9a9d3fce379108c89395266eb9958a24eabb1edbeaabc860f82507e111

  • SHA512

    d067dd44be85fdb041bf6abacac326d8c53268a8a2d427a71372237ece4d75a961f7961a77c09ea0fedbac1044783ea57b7bfaf98b2822107bfd6c3429048453

  • SSDEEP

    98304:AhVTI9+j2e09C7HDkNsMtV4KfkxCUu9MGS9Lta3RO:WJc4TYsMt2KfkxCn9qM3RO

Score
10/10
credmoduleminerbackdoorldr4amadeyxmrigmountlockersunburstgozigrowtopia

Malware Config

Extracted

Family

gozi

Signatures

  • Amadey family
    amadey
  • Detect Amadey credential stealer module 1 IoCs
    credmodule
  • Detected Mount Locker ransomware 1 IoCs
  • Detected SUNBURST backdoor 1 IoCs

    SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

    backdoor
  • Gozi family
    gozi
  • Growtopia family
    growtopia
  • Mountlocker family
    mountlocker
  • Sunburst family
    sunburst
  • XMRig Miner payload 1 IoCs
    miner
  • Xmrig family
    xmrig
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 01347dd4214ef8ce566216467f2c8047.bin
    .zip

    Password: infected

  • a3c341fdeeaa3c8d1462042aef68f99c75c5c301bab46b0d6973db1fc905918c.dll
    .dll windows x86

    Password: infected


    Headers

    Sections