Overview

overview

10

Static

static

5

72d2fcb709...7e.exe

windows7-x64

10

72d2fcb709...7e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    72d2fcb709a2bf07214901ffa2b9aea792ee4fc4ff646646bfa02ddb8e775d7e.exe

  • Size

    1018KB

  • Sample

    240723-cyn5fsshml

  • MD5

    49486b75e6f4777a065deb35753d2165

  • SHA1

    c58c050e43297f54bb38823d9984c7a1fb6c1191

  • SHA256

    72d2fcb709a2bf07214901ffa2b9aea792ee4fc4ff646646bfa02ddb8e775d7e

  • SHA512

    305366258a46166bd8dbe1556efce3110d83560f88e63ee80872b85b2659bcf00c1fbec4460238626813782dd0cccbc18d0398f661a045d5bde84056e9301e73

  • SSDEEP

    24576:6AHnh+eWsN3skA4RV1Hom2KXMmHaOa7USpi7jh5:Nh+ZkldoPK8YaOabm

Score
10/10
collection

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.schafoundation.org
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    schafEST2012.

Targets

    • Target

      72d2fcb709a2bf07214901ffa2b9aea792ee4fc4ff646646bfa02ddb8e775d7e.exe

    • Size

      1018KB

    • MD5

      49486b75e6f4777a065deb35753d2165

    • SHA1

      c58c050e43297f54bb38823d9984c7a1fb6c1191

    • SHA256

      72d2fcb709a2bf07214901ffa2b9aea792ee4fc4ff646646bfa02ddb8e775d7e

    • SHA512

      305366258a46166bd8dbe1556efce3110d83560f88e63ee80872b85b2659bcf00c1fbec4460238626813782dd0cccbc18d0398f661a045d5bde84056e9301e73

    • SSDEEP

      24576:6AHnh+eWsN3skA4RV1Hom2KXMmHaOa7USpi7jh5:Nh+ZkldoPK8YaOabm

    Score
    10/10
    collection

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks