General
-
Target
7c05833514baa8de4f997a7fcb04096316f2fb44d77fcc0951bb50adbf8d58f5
-
Size
1.0MB
-
Sample
240417-leddaaah47
-
MD5
0a286d2f6060a92d15ddfd03063a1486
-
SHA1
172ae7b2059b420c463daf8ca58a55d8ab500d5c
-
SHA256
7c05833514baa8de4f997a7fcb04096316f2fb44d77fcc0951bb50adbf8d58f5
-
SHA512
bdcccaf8f7636bb54d74d1a1ead3288234a787c3b6d9c3d96e3584fc520088c97c98130e8fe030a1ee9551376b270f0ee5c6e53dd44581850e73abc9493d4cc7
-
SSDEEP
6144:X9mI/A/bpCQqR5yqL5pbqD8T/ruThC711qC711Q:X9ro/4QqLrqDC/ru8PDPQ
Static task
static1
Behavioral task
behavioral1
Sample
7c05833514baa8de4f997a7fcb04096316f2fb44d77fcc0951bb50adbf8d58f5.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
7c05833514baa8de4f997a7fcb04096316f2fb44d77fcc0951bb50adbf8d58f5.exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
7c05833514baa8de4f997a7fcb04096316f2fb44d77fcc0951bb50adbf8d58f5.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
7c05833514baa8de4f997a7fcb04096316f2fb44d77fcc0951bb50adbf8d58f5.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
systembc
yan0212.com:4039
yan0212.net:4039
Targets
-
-
Target
7c05833514baa8de4f997a7fcb04096316f2fb44d77fcc0951bb50adbf8d58f5
-
Size
1.0MB
-
MD5
0a286d2f6060a92d15ddfd03063a1486
-
SHA1
172ae7b2059b420c463daf8ca58a55d8ab500d5c
-
SHA256
7c05833514baa8de4f997a7fcb04096316f2fb44d77fcc0951bb50adbf8d58f5
-
SHA512
bdcccaf8f7636bb54d74d1a1ead3288234a787c3b6d9c3d96e3584fc520088c97c98130e8fe030a1ee9551376b270f0ee5c6e53dd44581850e73abc9493d4cc7
-
SSDEEP
6144:X9mI/A/bpCQqR5yqL5pbqD8T/ruThC711qC711Q:X9ro/4QqLrqDC/ru8PDPQ
-
Contacts a large (923) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications
Malware can proxy its traffic through Tor for more anonymity.
-