General
-
Target
СПЦ №130 от 12.04.2024 подпис..exe
-
Size
987KB
-
Sample
240424-fej8yafb3s
-
MD5
189590b2755ed6f134d8fe2c05124926
-
SHA1
e492eb975348e50a32c792d26441cc00912987e7
-
SHA256
8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27
-
SHA512
bf1280546ff4dacddd1b5d08a3a447bb8ccbe2e7c974654e43a266507d6c82080b6f802e4e96ef9f6c5dc0dbc43df64782d66d99e134797971427e88c32219fb
-
SSDEEP
24576:gIqqULDjF7yCOrJHFTuvMJbmhQU/YydIE5Lt6:9sxANuvMxmhB/Yly6
Malware Config
Targets
-
-
Target
СПЦ №130 от 12.04.2024 подпис..exe
-
Size
987KB
-
MD5
189590b2755ed6f134d8fe2c05124926
-
SHA1
e492eb975348e50a32c792d26441cc00912987e7
-
SHA256
8987f3cd89bd9f739ef4ee2495ccd81be89cf7d5f52b445c94920cfae3b0fc27
-
SHA512
bf1280546ff4dacddd1b5d08a3a447bb8ccbe2e7c974654e43a266507d6c82080b6f802e4e96ef9f6c5dc0dbc43df64782d66d99e134797971427e88c32219fb
-
SSDEEP
24576:gIqqULDjF7yCOrJHFTuvMJbmhQU/YydIE5Lt6:9sxANuvMxmhB/Yly6
Score10/10-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
Entreprenren.Out
-
Size
60KB
-
MD5
030ce4392c4a8cc1b477bc3deeacb683
-
SHA1
8f36406d9572e6ccf966fb69c0934c234e0617e6
-
SHA256
7e9decd5f91e30b000266db010c2ad399bfd06f64ec43f48ca0f3bc36d69ca6c
-
SHA512
3ec59592857d073ea3f59cd5279fdd4d862ba0a102de7bb3f96db73b64af362c5f017802afe78cb5299a0185f406e4fec097c9986b74d591183ab2aba114e4f4
-
SSDEEP
1536:cwCVtHft7/anji7OG2BP79MU59/AmW1K7V:cJt7SnjHG2Bj9V3AmW85
Score8/10-
Modifies Installed Components in the registry
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-