Extracted

• • Target
    da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c
  • Size 30KB
  • SHA256 da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c
  • MD5 b950169921d1437cef4a85778cd81636
  • SHA1 3d20b1c6f93029ab557819efd1f32afc25ac1e88
  • SHA512 d0b87c1a119ba712c8b85fcb442286133320ec03df589276106987f2947ebbc603dfabaad7e2efbec4998067ef508f1c12bbc5a54502097665315a7b9ba9cf70
  • SSDEEP 768:Ugj98hSEzIOxO+OZWBaFWsBC7wU6LPLoEf73Wud9BdoJrZmZEMb+:Z0IOxO+OZWBGWsB+w93L39BdoD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  • Blocklisted process makes network request

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  behavioral1behavioral2behavioral3behavioral4behavioral5