General
-
Target
548ab8ae8f4bb83d0a55d05689e9695237882f567f25e72a5aac79b70845480a
-
Size
4.0MB
-
Sample
240422-fvjmcaga93
-
MD5
b6a4d503871d781c0d67ae568ba2f690
-
SHA1
c8df0476d353c1259667d372b2f33f053f0c889c
-
SHA256
548ab8ae8f4bb83d0a55d05689e9695237882f567f25e72a5aac79b70845480a
-
SHA512
05e4e8442aa41cd4ecf00f6c7c6721752692b1f2ec7d9047d39f1bdd6b5a49eb58ade0372b534f63aad8539e3c5d52e1c533a5b0c7dfab35c7bca764041654cd
-
SSDEEP
98304:7arJyuI1299LWGA8v9I9nCDjMVw9XBWP2hphtJwm7eSoqO:ckuItGuFgqw9NDhom9y
Static task
static1
Behavioral task
behavioral1
Sample
548ab8ae8f4bb83d0a55d05689e9695237882f567f25e72a5aac79b70845480a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
548ab8ae8f4bb83d0a55d05689e9695237882f567f25e72a5aac79b70845480a.exe
Resource
win10-20240404-en
Malware Config
Extracted
socks5systemz
http://bxobeox.com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6489f913c7e990
http://ckitlfy.net/search/?q=67e28dd86809f27b415ba51b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffc16c6ed929c38
http://ckitlfy.net/search/?q=67e28dd86809f27b415ba51b7c27d78406abdd88be4b12eab517aa5c96bd86ee9c824b815a8bbc896c58e713bc90c94836b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee969d3dcf689015
Targets
-
-
Target
548ab8ae8f4bb83d0a55d05689e9695237882f567f25e72a5aac79b70845480a
-
Size
4.0MB
-
MD5
b6a4d503871d781c0d67ae568ba2f690
-
SHA1
c8df0476d353c1259667d372b2f33f053f0c889c
-
SHA256
548ab8ae8f4bb83d0a55d05689e9695237882f567f25e72a5aac79b70845480a
-
SHA512
05e4e8442aa41cd4ecf00f6c7c6721752692b1f2ec7d9047d39f1bdd6b5a49eb58ade0372b534f63aad8539e3c5d52e1c533a5b0c7dfab35c7bca764041654cd
-
SSDEEP
98304:7arJyuI1299LWGA8v9I9nCDjMVw9XBWP2hphtJwm7eSoqO:ckuItGuFgqw9NDhom9y
Score10/10-
Detect Socks5Systemz Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-