Overview
overview
10Static
static
3bin.exe
windows7-x64
7bin.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Joukerypaw...45.dot
windows7-x64
1Joukerypaw...45.dot
windows10-2004-x64
1Spadseretu...rs.com
windows7-x64
Spadseretu...rs.com
windows10-2004-x64
kalkagtig.com
windows7-x64
kalkagtig.com
windows10-2004-x64
General
-
Target
bin.exe
-
Size
992KB
-
Sample
240322-s1wkbafe3x
-
MD5
e63cfbd518e5a8466c190a4c6fcc3ef1
-
SHA1
6d2fab13f44daf6c50fd9baf10317fdf03f46443
-
SHA256
bfd50523e4cabf7fe9e6f0afc926b9269708ac80af43a943ebcbc909a9ae0695
-
SHA512
83ca654f47268d03b15d73db4f2dc247ce4b356eae8a9663507fb7729fcd4cc62d5d501ac2aa4bcc8703fd58ad161bfdbdcb35e62203623f3d0e7e60c890dd09
-
SSDEEP
24576:bT3CXCkOoTMDPfzHfIsUA7vwD7tNx2cGHgj42:btUMbjYA7ytN+gj42
Static task
static1
Behavioral task
behavioral1
Sample
bin.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bin.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Joukerypawkery/Zymosterol/Radioneuritis145.dot
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Joukerypawkery/Zymosterol/Radioneuritis145.dot
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Spadseretures/Altsaxofoners.com
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Spadseretures/Altsaxofoners.com
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
kalkagtig.com
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
kalkagtig.com
Resource
win10v2004-20240319-en
Malware Config
Targets
-
-
Target
bin.exe
-
Size
992KB
-
MD5
e63cfbd518e5a8466c190a4c6fcc3ef1
-
SHA1
6d2fab13f44daf6c50fd9baf10317fdf03f46443
-
SHA256
bfd50523e4cabf7fe9e6f0afc926b9269708ac80af43a943ebcbc909a9ae0695
-
SHA512
83ca654f47268d03b15d73db4f2dc247ce4b356eae8a9663507fb7729fcd4cc62d5d501ac2aa4bcc8703fd58ad161bfdbdcb35e62203623f3d0e7e60c890dd09
-
SSDEEP
24576:bT3CXCkOoTMDPfzHfIsUA7vwD7tNx2cGHgj42:btUMbjYA7ytN+gj42
Score10/10-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b
-
SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785
-
SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
-
SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
-
SSDEEP
96:zPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+y:zPtkuWJX7zB3kGwfy0nyUVsxCjOM61u
Score3/10 -
-
-
Target
Joukerypawkery/Zymosterol/Radioneuritis145.dot
-
Size
1KB
-
MD5
3c67f36fe001995937248ff24fd768a3
-
SHA1
6f76358278df4b4aada93133ecbb379f76879dc5
-
SHA256
3be353d4df1903b1f2a45d81365cecc95d611421fd408631a8bbccd4b956a630
-
SHA512
36f87643bee965f8b8ec66c8a0ed7d7eef5d4cf36f04b5f552111c2587e75c2eded5949ecfcc6d54df81adde1a5ece409ec7659e4a8a849ccf284c23b140d2af
Score1/10 -
-
-
Target
Spadseretures/Altsaxofoners.com
-
Size
1KB
-
MD5
329f5d8f1a55a9dc14b832faff30a24e
-
SHA1
8bfed77a56a3655a47771b0df83da7c21d4006bf
-
SHA256
c598be3bc221a001eebabc46d37b52bb1479b9c1c4b0afee9cc336ce2e19770e
-
SHA512
b136020fd3e849145d40857bc781c32b5ad7c75b6a40cbc2e97b77b68a27008107604b826c5237e630e60d6bf20f12842d0d210599756dc0129da678f21e8a04
Score1/10 -
-
-
Target
kalkagtig.com
-
Size
1KB
-
MD5
fc72f8797187d0ffa2e1cdf46a892191
-
SHA1
e37c1c80daa7269238e2a365c5b34986302217c3
-
SHA256
07013add9d63848f4b8cc49eb4622483161d9f76cdad651d22e67ff58c0244a2
-
SHA512
f0ec7cc8ee979004ecac1850f50be4ad06078f0c5b5742cb5c60aaa43c6e8a8cd1b05512277c0f83a92391843eb95766d8c23e48a17ea4f7257e268343eb6504
Score1/10 -