General
-
Target
7272273eb523020414a5a02f91a3922a.exe
-
Size
3.9MB
-
Sample
240419-g4wtpsag77
-
MD5
7272273eb523020414a5a02f91a3922a
-
SHA1
3bdf99591a1949cad49f3649590430c927110b86
-
SHA256
6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5
-
SHA512
43b4a0497f89eda59c8e24e552c9af33f2bc84ead0f52027130664eafa9c448b896198cdecf1b8edd127a0184bae9e26e4550d20bd8443304404949c5975f77a
-
SSDEEP
98304:7ank3YFLhyADS1cWwcD1qTNOdZXfGbfdjCaN09iyJp:B3YFEZcvIvubdjCd
Static task
static1
Behavioral task
behavioral1
Sample
7272273eb523020414a5a02f91a3922a.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
7272273eb523020414a5a02f91a3922a.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
socks5systemz
http://ebuubtb.ua/search/?q=67e28dd8655bfa7a130da94c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f371ea771795af8e05c644db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a648bff16c8ee96
http://csswder.net/search/?q=67e28dd86b5ca721490da9197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a571ea771795af8e05c644db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffc14c0e892933b
http://csswder.net/search/?q=67e28dd86b5ca721490da9197c27d78406abdd88be4b12eab517aa5c96bd86ee9d864d815a8bbc896c58e713bc90c91936b5281fc235a925ed3e06d6bd974a95129070b617e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee969f3bca689f16
Targets
-
-
Target
7272273eb523020414a5a02f91a3922a.exe
-
Size
3.9MB
-
MD5
7272273eb523020414a5a02f91a3922a
-
SHA1
3bdf99591a1949cad49f3649590430c927110b86
-
SHA256
6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5
-
SHA512
43b4a0497f89eda59c8e24e552c9af33f2bc84ead0f52027130664eafa9c448b896198cdecf1b8edd127a0184bae9e26e4550d20bd8443304404949c5975f77a
-
SSDEEP
98304:7ank3YFLhyADS1cWwcD1qTNOdZXfGbfdjCaN09iyJp:B3YFEZcvIvubdjCd
Score10/10-
Detect Socks5Systemz Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-