General
-
Target
PAP46E1UkZ.exe
-
Size
18.4MB
-
Sample
240429-y222dabe42
-
MD5
bb1cb5cd557cac752ccea3f4ba806709
-
SHA1
7054b75fd5af905210178703a556fa5837b4f459
-
SHA256
2ac633521283d233a8478547cb6f8109c6f318a1b0c8e9f822833b5c74c12b39
-
SHA512
c21d2c7cf6907c5c4122ef0fba9ddb3faff3c98c44c18242cd348a2016b4d5365acf97cf6575931656f60f60b6810d848e02a5a021e7a57ce9d69a5a74f32de3
-
SSDEEP
393216:DEkULrpBciidQuslrfrAZYCuPJO8z19P2uDW8B3+d9vkegs+EjY1:D85BydQu4MJuxZz1RbW8BOd9vkz/yY1
Behavioral task
behavioral1
Sample
PAP46E1UkZ.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
WindowsLibrary.pyc
Resource
win10v2004-20240419-en
Malware Config
Targets
-
-
Target
PAP46E1UkZ.exe
-
Size
18.4MB
-
MD5
bb1cb5cd557cac752ccea3f4ba806709
-
SHA1
7054b75fd5af905210178703a556fa5837b4f459
-
SHA256
2ac633521283d233a8478547cb6f8109c6f318a1b0c8e9f822833b5c74c12b39
-
SHA512
c21d2c7cf6907c5c4122ef0fba9ddb3faff3c98c44c18242cd348a2016b4d5365acf97cf6575931656f60f60b6810d848e02a5a021e7a57ce9d69a5a74f32de3
-
SSDEEP
393216:DEkULrpBciidQuslrfrAZYCuPJO8z19P2uDW8B3+d9vkegs+EjY1:D85BydQu4MJuxZz1RbW8BOd9vkz/yY1
Score8/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
WindowsLibrary.pyc
-
Size
29KB
-
MD5
7b3f5e57516c8db5e6b96208fb77a61e
-
SHA1
eb77ed510e62ce35b3f292da2533d480000c1a38
-
SHA256
e33f3b2997d0710dbeeebad40c77fc21f58f61c6c21cebb8776f0069a0379ad3
-
SHA512
17820fced58e8e7e4ecc3912c871a42ce84a53e28b3d2bf8627a8184f773227c59fe062fc991db5608434fae10f69f9b1cf78322551feafcaf6c0513598b269a
-
SSDEEP
768:0wOR/Jt4/VZQUuS2JO0r8ZekDjpTXFDQSGx5JY2:0w0c/VCS247ekDJzGx5T
Score3/10 -