General
-
Target
2d7c468246a690d8df89e69f7a349b52574e0ce37d0dc5e04dc94f14d811615a
-
Size
431KB
-
Sample
240909-ntmavaybka
-
MD5
e12f17607a6f70b44471398aeff832a5
-
SHA1
22c1472e64aa415750315beaf4ae1a0fe19fddeb
-
SHA256
2d7c468246a690d8df89e69f7a349b52574e0ce37d0dc5e04dc94f14d811615a
-
SHA512
e316f110c333c0a390faae9411f13efce95b3d191afcfc8e2a35c23438da8cbefb49d9e72a22dcc9b7b2e2b23ddbcefbf8e41bc81d7b81bc310693a444a6023a
-
SSDEEP
12288:BajL+BfqlWhVqmhbS975O2ZJIYiR6GhR2gKSQ6rs50a:BanutMmc51J1iHhEz9680a
Malware Config
Targets
-
-
Target
2d7c468246a690d8df89e69f7a349b52574e0ce37d0dc5e04dc94f14d811615a
-
Size
431KB
-
MD5
e12f17607a6f70b44471398aeff832a5
-
SHA1
22c1472e64aa415750315beaf4ae1a0fe19fddeb
-
SHA256
2d7c468246a690d8df89e69f7a349b52574e0ce37d0dc5e04dc94f14d811615a
-
SHA512
e316f110c333c0a390faae9411f13efce95b3d191afcfc8e2a35c23438da8cbefb49d9e72a22dcc9b7b2e2b23ddbcefbf8e41bc81d7b81bc310693a444a6023a
-
SSDEEP
12288:BajL+BfqlWhVqmhbS975O2ZJIYiR6GhR2gKSQ6rs50a:BanutMmc51J1iHhEz9680a
Score10/10-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload
-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-