Overview

overview

10

Static

static

10

462505ad0f...d9.dll

windows7-x64

3

462505ad0f...d9.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    462505ad0fd657e7b031b0a3706fdcd04a20402c185b82caec91e29c2ff1e2d9
  • Size 8.1MB
  • Sample241115-e2pw9sygnm
  • SHA256 462505ad0fd657e7b031b0a3706fdcd04a20402c185b82caec91e29c2ff1e2d9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
credmoduleminerbackdoorldr4amadeyxmrigmountlockersunburstgozigrowtopia

Malware Config

Extracted

Family

  • gozi

Signatures

  • Amadey family
    amadey
  • Detect Amadey credential stealer module 1 IoCs
    credmodule
  • Detected Mount Locker ransomware 1 IoCs
  • Detected SUNBURST backdoor 1 IoCs

    SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

    backdoor
  • Gozi family
    gozi
  • Growtopia family
    growtopia
  • Mountlocker family
    mountlocker
  • Sunburst family
    sunburst
  • XMRig Miner payload 1 IoCs
    miner
  • Xmrig family
    xmrig
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 462505ad0fd657e7b031b0a3706fdcd04a20402c185b82caec91e29c2ff1e2d9
    .dll 8.1MB

462505ad0fd657e7b031b0a3706fdcd04a20402c185b82caec91e29c2ff1e2d9

  • SHA256 462505ad0fd657e7b031b0a3706fdcd04a20402c185b82caec91e29c2ff1e2d9
  • MD5 SHA1 SHA512 SSDEEP
windows:5windowsx86arch:x86

  • Detect Amadey credential stealer module

    credmodule

  • Detected Mount Locker ransomware

  • Detected SUNBURST backdoor

    SUNBURST is a backdoor for the SolarWinds Orion platform with extensive capabilities.

    backdoor

  • XMRig Miner payload

    miner

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
1
Major OS version
5
Entry point
161046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL
PDB paths