General
-
Target
infected2024071401.zip
-
Size
54.3MB
-
Sample
250121-m7zbws1kfn
-
MD5
1deae7b244bd725828d39c59ccb36f5b
-
SHA1
af1298cefef18ddae3bc472b61828d4b8ee30594
-
SHA256
c56c00ca3f42026f17affef76b3752f268d1498f862b3143985ca7c1d33feb39
-
SHA512
15d37132af78f43b79da983fdd7db5a6716d9eded87568e1c1a24a8241f5e4e0f7de22b6c72a0640dd027ddc50f2f24fdb0ec5b8a2ed606588e2ce80aa873bbe
-
SSDEEP
1572864:ZCPcetzLnPM24Z4Ienxa/x4AW+kTpM/vpnT:M3LnPHxACSkTpqvpnT
Malware Config
Targets
-
-
Target
infected2024071401.zip
-
Size
54.3MB
-
MD5
1deae7b244bd725828d39c59ccb36f5b
-
SHA1
af1298cefef18ddae3bc472b61828d4b8ee30594
-
SHA256
c56c00ca3f42026f17affef76b3752f268d1498f862b3143985ca7c1d33feb39
-
SHA512
15d37132af78f43b79da983fdd7db5a6716d9eded87568e1c1a24a8241f5e4e0f7de22b6c72a0640dd027ddc50f2f24fdb0ec5b8a2ed606588e2ce80aa873bbe
-
SSDEEP
1572864:ZCPcetzLnPM24Z4Ienxa/x4AW+kTpM/vpnT:M3LnPHxACSkTpqvpnT
Score3/10 -
-
-
Target
1�L�iŚ.pyc
-
Size
857B
-
MD5
0d05ea9df13972dc4ded98244e029da4
-
SHA1
439cc2f447bc7a5ea554279491664e0ba699333d
-
SHA256
aa18b36e8260dbfaffe4191216319556ae73c8654f358315aba43e87a9193317
-
SHA512
5217184928a86a04b8ce4f5380882ff49ac5aa4bdcbf70090abe8be479038806e5aabcf7fc2c65d35662c77c1776233c90f09a4ff3c41061f981f68db63b778f
Score1/10 -
-
-
Target
helper.bat
-
Size
27KB
-
MD5
8d987e2f2fef6f2bd726d392bac46c55
-
SHA1
64ab8a696b52189d5fd809da924d1dc36e07d7c3
-
SHA256
10e4a6b54cc0cf4d18dde8b69e0b305abe487e07ed990c5bff82ce30b217b910
-
SHA512
a8c48da620cfc0b4ea55efba87a98625e4b1eaf4553006a259fc5915836afcdee413180d1dcfc40ab8830741257f5ab723d4536788b0d751a6ba8a28cbfcdf45
-
SSDEEP
768:AZWM6xwaPdP30trmRblevg8heVbaEUdLQdy6VTRZE3mn:ZM6xzR30ZmRb4YI2TILQdy6VTRL
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
-
-
Target
setup.exe
-
Size
5.0MB
-
MD5
d6dd2275a92bd37adb3a886255a431ef
-
SHA1
a28933f79041f29a681cfb444fc7b8d63435c510
-
SHA256
e51f3f998cd7c0783deb68c18c39b6ccf77f5dca0b611ddd23dcf09845ab8b31
-
SHA512
1c303bf3dfc8ba54d02096615cdbf34752a312c2478f16c3fc38a8e75b2ab0619fb46e434b2b96aa89114873c3659db91fb9e0308fe47d91d0b9124e48814ded
-
SSDEEP
98304:Cf6hoGwhlxoORmkoq6LoTxHVo81F728I/e6KMMj9BZCloOhyNnh+IDQxb:avpeAZILoTFT1s8n9TfhdDQB
Score10/10-
Detect Socks5Systemz Payload
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Socks5systemz family
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-