General
-
Target
6eaccbf0dd19090919338e8d72d5e2f3e0bcf8a9ab26d48db585e1e9d1d06cde
-
Size
432KB
-
Sample
240908-xtxw1stfme
-
MD5
20d17a804accc59d421c3b4ea39d8525
-
SHA1
500fd8508a2d81faac63645d65b68cc61dbd49e1
-
SHA256
6eaccbf0dd19090919338e8d72d5e2f3e0bcf8a9ab26d48db585e1e9d1d06cde
-
SHA512
c8a075802becc9a1a0f5012203f29dc67e63b42d7b4e654aefed0688b6ffeb3a6a5dca175a43980f4355d15f149e1dae64d4308439df7752f66f5fc59e567a25
-
SSDEEP
12288:kov9YJjrV+pJR6cuXFqaYCL9yKASIAcl3hkWWlyvQw:B+JHVyR6xXky0KASbcdh6yvQw
Malware Config
Targets
-
-
Target
6eaccbf0dd19090919338e8d72d5e2f3e0bcf8a9ab26d48db585e1e9d1d06cde
-
Size
432KB
-
MD5
20d17a804accc59d421c3b4ea39d8525
-
SHA1
500fd8508a2d81faac63645d65b68cc61dbd49e1
-
SHA256
6eaccbf0dd19090919338e8d72d5e2f3e0bcf8a9ab26d48db585e1e9d1d06cde
-
SHA512
c8a075802becc9a1a0f5012203f29dc67e63b42d7b4e654aefed0688b6ffeb3a6a5dca175a43980f4355d15f149e1dae64d4308439df7752f66f5fc59e567a25
-
SSDEEP
12288:kov9YJjrV+pJR6cuXFqaYCL9yKASIAcl3hkWWlyvQw:B+JHVyR6xXky0KASbcdh6yvQw
Score10/10-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload
-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-