General
-
Target
3ad5eda009261333870f4bf241ac556b8bcc7e7d2e0395b204256c8ea2402775N
-
Size
437KB
-
Sample
241001-v1nwks1gnp
-
MD5
f111d4370e3267a0a91dfeab083756f0
-
SHA1
c4660bd2a09217e8db5bca929ecc0e840e3b9650
-
SHA256
3ad5eda009261333870f4bf241ac556b8bcc7e7d2e0395b204256c8ea2402775
-
SHA512
917e70333aff3e5b76c1582326618670bc6a6ea473bba690628cfcf12358dde7399b3706f1c8f7bf8a95dbe6315cd1f0bde1795059c98edbb49300b09bc5eadd
-
SSDEEP
6144:bas0ZLc/IJvCklIqA8mvHwgnHJp9OWqw7zsK0bencTpX4KtjY5Jt/lt0zwzOu6Wl:gBFJqk2q1g5ppemr0bAKoNfnQCSWpoS/
Malware Config
Targets
-
-
Target
3ad5eda009261333870f4bf241ac556b8bcc7e7d2e0395b204256c8ea2402775N
-
Size
437KB
-
MD5
f111d4370e3267a0a91dfeab083756f0
-
SHA1
c4660bd2a09217e8db5bca929ecc0e840e3b9650
-
SHA256
3ad5eda009261333870f4bf241ac556b8bcc7e7d2e0395b204256c8ea2402775
-
SHA512
917e70333aff3e5b76c1582326618670bc6a6ea473bba690628cfcf12358dde7399b3706f1c8f7bf8a95dbe6315cd1f0bde1795059c98edbb49300b09bc5eadd
-
SSDEEP
6144:bas0ZLc/IJvCklIqA8mvHwgnHJp9OWqw7zsK0bencTpX4KtjY5Jt/lt0zwzOu6Wl:gBFJqk2q1g5ppemr0bAKoNfnQCSWpoS/
Score10/10-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload
-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-