General
-
Target
b649a3f25df687508fa92c830dfa13b13a486f62ab344bb8d0214bd5b8172b2f
-
Size
437KB
-
Sample
240815-kqly5ayhqq
-
MD5
abae4af7a07f8ed36abc6a489f448167
-
SHA1
551b67260bfabde2bc8527b46a906e1dfb1cfb6c
-
SHA256
b649a3f25df687508fa92c830dfa13b13a486f62ab344bb8d0214bd5b8172b2f
-
SHA512
71e75b13713d455d101bff548a1f856e2f506b18464be33f95c5033dfa1ca46d293500ca42b88ac7e6a1addf749b71574463d780e53873f7543780a3adaf7e55
-
SSDEEP
6144:bas0ZLc/IJvCklIqA8mvHwgnHJp9OWqw7zsK0bencTpX4KtjY5Jt/lt0zwzOu6W4:gBFJqk2q1g5ppemr0bAKoNfnQCSWpoSi
Malware Config
Targets
-
-
Target
b649a3f25df687508fa92c830dfa13b13a486f62ab344bb8d0214bd5b8172b2f
-
Size
437KB
-
MD5
abae4af7a07f8ed36abc6a489f448167
-
SHA1
551b67260bfabde2bc8527b46a906e1dfb1cfb6c
-
SHA256
b649a3f25df687508fa92c830dfa13b13a486f62ab344bb8d0214bd5b8172b2f
-
SHA512
71e75b13713d455d101bff548a1f856e2f506b18464be33f95c5033dfa1ca46d293500ca42b88ac7e6a1addf749b71574463d780e53873f7543780a3adaf7e55
-
SSDEEP
6144:bas0ZLc/IJvCklIqA8mvHwgnHJp9OWqw7zsK0bencTpX4KtjY5Jt/lt0zwzOu6W4:gBFJqk2q1g5ppemr0bAKoNfnQCSWpoSi
Score10/10-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload
-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-