Analysis

  • max time kernel
    92s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2024, 09:56 UTC

General

  • Target

    So1araBootstrappzxcvbnf.zip

  • Size

    75.0MB

  • MD5

    1a1fbb907aead7d59a4821d4df3fa448

  • SHA1

    32acdd0a119b6eef7e5269655c0b9a4cd5632065

  • SHA256

    c221df92ab8ad749226c07b8951349a0d0fa6aff77b25357e8942e5c64c612b0

  • SHA512

    6f7709f08a1426970a4b6453d072c4ae807c16f20911f97dff3f39f13828a97d27ddffe56818ecc671fb26ea8bedf2d6724f6ce7d9847453638e44a7b8b22c73

  • SSDEEP

    1572864:qCoXmi8RpFrpAzLEvR2Hxefu8qs8uyht1dTSUPvLeFclMR0G+HpA:qtXPILALEqefoBPRBPvSFYXa

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\So1araBootstrappzxcvbnf.zip
    1⤵
      PID:2588

    Network

    • flag-us
      DNS
      82.177.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      82.177.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      103.169.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      103.169.127.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      20.58.20.217.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      20.58.20.217.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      21.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      21.236.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      82.177.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      82.177.190.20.in-addr.arpa

    • 8.8.8.8:53
      55.36.223.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      55.36.223.20.in-addr.arpa

    • 8.8.8.8:53
      103.169.127.40.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      103.169.127.40.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      20.58.20.217.in-addr.arpa
      dns
      71 B
      131 B
      1
      1

      DNS Request

      20.58.20.217.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      21.236.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      21.236.111.52.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.