General
-
Target
6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5.exe
-
Size
3.9MB
-
Sample
240420-bxvp6sdg9v
-
MD5
7272273eb523020414a5a02f91a3922a
-
SHA1
3bdf99591a1949cad49f3649590430c927110b86
-
SHA256
6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5
-
SHA512
43b4a0497f89eda59c8e24e552c9af33f2bc84ead0f52027130664eafa9c448b896198cdecf1b8edd127a0184bae9e26e4550d20bd8443304404949c5975f77a
-
SSDEEP
98304:7ank3YFLhyADS1cWwcD1qTNOdZXfGbfdjCaN09iyJp:B3YFEZcvIvubdjCd
Static task
static1
Behavioral task
behavioral1
Sample
6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
socks5systemz
http://cefwicu.net/search/?q=67e28dd83d5fa62d1358fa4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978ff71ea771795af8e05c644db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a648bf817c7e694
http://ckjqxqt.net/search/?q=67e28dd86d08fa7a460df84e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa45e8889b5e4fa9281ae978a271ea771795af8e05c644db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffc14c7e992923b
http://ckjqxqt.net/search/?q=67e28dd86d08fa7a460df84e7c27d78406abdd88be4b12eab517aa5c96bd86e891814f825a8bbc896c58e713bc90c91036b5281fc235a925ed3e01d6bd974a95129070b617e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee969f3ccb689e16
Targets
-
-
Target
6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5.exe
-
Size
3.9MB
-
MD5
7272273eb523020414a5a02f91a3922a
-
SHA1
3bdf99591a1949cad49f3649590430c927110b86
-
SHA256
6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5
-
SHA512
43b4a0497f89eda59c8e24e552c9af33f2bc84ead0f52027130664eafa9c448b896198cdecf1b8edd127a0184bae9e26e4550d20bd8443304404949c5975f77a
-
SSDEEP
98304:7ank3YFLhyADS1cWwcD1qTNOdZXfGbfdjCaN09iyJp:B3YFEZcvIvubdjCd
Score10/10-
Detect Socks5Systemz Payload
-
Detects executables packed with VMProtect.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-