bae2b47193c08a9f98f390845d8a2d25040bc2b2cee6c36f10cfff5d245b24ea

General

Target
FYSWIFT09-MR7Y280-UR8993-93-KSLI0002-RD0003-D.exe
Size 614KB
Sample251209-clys5abx2e
SHA256 bae2b47193c08a9f98f390845d8a2d25040bc2b2cee6c36f10cfff5d245b24ea
MD5 999190bdbf9716143f68977747ec0824
SHA1 036d7322a3ca1cf24fabfb17e0676a3c8364f5cb
SHA512 e891ff3fb91180d9bf76db225cf1993f38a16e8cc98a218f27a40b47d4ce2a111eac453b40122fbfc4e893232b41d68db4cb2a2020abe90a9d7a6dbe31846a94
SSDEEP 12288:J6L45thap5UwTk26UjwTbcl6IyyBx/13MRkHZ:J6cthapq6k3owTbOyyD13MR6Z
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  FYSWIFT09-MR7Y280-UR8993-93-KSLI0002-RD0003-D.exe
- Size 614KB
- SHA256 bae2b47193c08a9f98f390845d8a2d25040bc2b2cee6c36f10cfff5d245b24ea
- MD5 999190bdbf9716143f68977747ec0824
- SHA1 036d7322a3ca1cf24fabfb17e0676a3c8364f5cb
- SHA512 e891ff3fb91180d9bf76db225cf1993f38a16e8cc98a218f27a40b47d4ce2a111eac453b40122fbfc4e893232b41d68db4cb2a2020abe90a9d7a6dbe31846a94
- SSDEEP 12288:J6L45thap5UwTk26UjwTbcl6IyyBx/13MRkHZ:J6cthapq6k3owTbOyyD13MR6Z
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
- MD5 ec9640b70e07141febbe2cd4cc42510f
- SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
- SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
- SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6