General
-
Target
54.exe
-
Size
126.9MB
-
Sample
241122-b13vys1phs
-
MD5
0e1b39c6dcca033d56408b25ec73a34c
-
SHA1
bdf1f4f39f9e26b6eb2826c75a5e612ea81bacdd
-
SHA256
981db65a918db89fba166dc5b9063d873ca4a2528cf9d56e8bf893fd53b98ba0
-
SHA512
b6ff681e36faff90768309d2f12a8607789660c77addacd88bf203e32555c66912ad7ef0e2329931962db62119ba33d9fb24983c8f82b34e18d73d9e4e080fa6
-
SSDEEP
3145728:GWrAYlpzUwzgWH8/KtNTiQxgMon0xzRkwYZ1KWQ:8YlhUjWH8CvTgMlSo
Static task
static1
Behavioral task
behavioral1
Sample
54.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
54.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
Protocol: ftp- Host:
65.21.198.54 - Port:
21 - Username:
admin2 - Password:
hb..123456
Targets
-
-
Target
54.exe
-
Size
126.9MB
-
MD5
0e1b39c6dcca033d56408b25ec73a34c
-
SHA1
bdf1f4f39f9e26b6eb2826c75a5e612ea81bacdd
-
SHA256
981db65a918db89fba166dc5b9063d873ca4a2528cf9d56e8bf893fd53b98ba0
-
SHA512
b6ff681e36faff90768309d2f12a8607789660c77addacd88bf203e32555c66912ad7ef0e2329931962db62119ba33d9fb24983c8f82b34e18d73d9e4e080fa6
-
SSDEEP
3145728:GWrAYlpzUwzgWH8/KtNTiQxgMon0xzRkwYZ1KWQ:8YlhUjWH8CvTgMlSo
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-