Overview

overview

10

Static

static

10

a3c341fdee...8c.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a3c341fdeeaa3c8d1462042aef68f99c75c5c301bab46b0d6973db1fc905918c.exe

  • Size

    8.2MB

  • MD5

    01347dd4214ef8ce566216467f2c8047

  • SHA1

    03348c2c52d6cf90bc66a9556fa7e86884c669d2

  • SHA256

    a3c341fdeeaa3c8d1462042aef68f99c75c5c301bab46b0d6973db1fc905918c

  • SHA512

    3c594143af7861f524cb7bbb8b77cab7711be6867c65505d9d1f7f0ce043274f6c6e73857c9834a0bbac2e89199ceffd8fe58662d158568187038a41d934462e

  • SSDEEP

    49152:CSFIqIJFY83N+qsoFGsimna6QTC5GCpNifB8kP7CcfaJDJk3uEi9y2zk9:krJ1woG2a3TS3pN26V9DQ9

Score
10/10
credmoduleminerbackdoorldr4amadeyxmrigmountlockersunburstgozigrowtopia

Malware Config

Extracted

Family

gozi

Signatures

  • Amadey family
    amadey
  • Detect Amadey credential stealer module 1 IoCs
    credmodule
  • Detected Mount Locker ransomware 1 IoCs
  • Detected SUNBURST backdoor 1 IoCs

    SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

    backdoor
  • Gozi family
    gozi
  • Growtopia family
    growtopia
  • Mountlocker family
    mountlocker
  • Sunburst family
    sunburst
  • XMRig Miner payload 1 IoCs
    miner
  • Xmrig family
    xmrig
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a3c341fdeeaa3c8d1462042aef68f99c75c5c301bab46b0d6973db1fc905918c.exe
    .dll windows:5 windows x86


    Headers

    Sections