General
-
Target
serverside.xyzexternal.exe
-
Size
6.0MB
-
Sample
241028-yfq2zswbnk
-
MD5
5a991ec34d988f0646119a2f858f28f4
-
SHA1
53fc617b72823a5b63a69281926eef07b4371912
-
SHA256
5c7aa4965abe87d06f609e62488e9b53e174dad5582b77932796776cc7d3ba3d
-
SHA512
2afdacbaa6782ced56f08b905d59145e77147f9b8b54eb6e0ac7806ff7c89c3090efdf68c6c38af6bae484b0cec7a3e4c5b6f6873d85235dda24cfa5a825e0ab
-
SSDEEP
98304:6MIu4+Dcd0I2iamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HbMX/3H3:6Pp+Dm0IMeNoInY7/sHfbRy9QX0pTk
Behavioral task
behavioral1
Sample
serverside.xyzexternal.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
serverside.xyzexternal.exe
-
Size
6.0MB
-
MD5
5a991ec34d988f0646119a2f858f28f4
-
SHA1
53fc617b72823a5b63a69281926eef07b4371912
-
SHA256
5c7aa4965abe87d06f609e62488e9b53e174dad5582b77932796776cc7d3ba3d
-
SHA512
2afdacbaa6782ced56f08b905d59145e77147f9b8b54eb6e0ac7806ff7c89c3090efdf68c6c38af6bae484b0cec7a3e4c5b6f6873d85235dda24cfa5a825e0ab
-
SSDEEP
98304:6MIu4+Dcd0I2iamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HbMX/3H3:6Pp+Dm0IMeNoInY7/sHfbRy9QX0pTk
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-