General
-
Target
42340c4e65aba76699fcf2381a3e3c3b06ba0af30f6c39682e249f4b9d288a96
-
Size
437KB
-
Sample
240910-w49g5azane
-
MD5
ea404811b088ab904e71a8131393d847
-
SHA1
88c29df8697bb06a1cf6812362fcc904edb7f479
-
SHA256
42340c4e65aba76699fcf2381a3e3c3b06ba0af30f6c39682e249f4b9d288a96
-
SHA512
4c4e9d51ab9bb802d134444232af0c48d0dc1b468437cec60544c05cf4cb64c1d3447e47f8982baa9c0a33b9e6bf9a478ba2cb3d6a7bf1bcb2cadb06ae3e0b40
-
SSDEEP
6144:bas0ZLc/IJvCklIqA8mvHwgnHJp9OWqw7zsK0bencTpX4KtjY5Jt/lt0zwzOu6W5:gBFJqk2q1g5ppemr0bAKoNfnQCSWpoSj
Malware Config
Targets
-
-
Target
42340c4e65aba76699fcf2381a3e3c3b06ba0af30f6c39682e249f4b9d288a96
-
Size
437KB
-
MD5
ea404811b088ab904e71a8131393d847
-
SHA1
88c29df8697bb06a1cf6812362fcc904edb7f479
-
SHA256
42340c4e65aba76699fcf2381a3e3c3b06ba0af30f6c39682e249f4b9d288a96
-
SHA512
4c4e9d51ab9bb802d134444232af0c48d0dc1b468437cec60544c05cf4cb64c1d3447e47f8982baa9c0a33b9e6bf9a478ba2cb3d6a7bf1bcb2cadb06ae3e0b40
-
SSDEEP
6144:bas0ZLc/IJvCklIqA8mvHwgnHJp9OWqw7zsK0bencTpX4KtjY5Jt/lt0zwzOu6W5:gBFJqk2q1g5ppemr0bAKoNfnQCSWpoSj
Score10/10-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload
-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-