General
- Target NTLite_setup_x64.exe
- Size 20.6MB
- Sample260502-e2m3nsg15s
- SHA256 eb6a4e6fc95eb861eb3c773fcdf491fef667f011df497f790a983e5d5d098e84
- MD5 8bc01fb257a765e903507c14c96d810e
- SHA1 f5294671ad0754d4efa805ea3dee95f0f7f72980
- SHA512 37c21003c320d85599d6e91f17114b95b0d49cdcd3a4cbf7ff822efb6a136ff950fba4acf6661a9f1246fdeca0bf0a69e367396debedfbfda743a64a96f5fa10
- SSDEEP 393216:el35CAC9Ni5hzScA99Z3x0OWgm/jXsAy2GgyH0BzSbuvZR+ltxbSVtHj19K8kZs4:ypVmc7jcAJGgyHBeZMXbSLHj1M8ks4
- TLSH T15627333BF18BA53EE06A2A357973A210483B7A70A5068C52D6DCF44CCF664711E3EB57
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Targets
-
- Target NTLite_setup_x64.exe
- Size 20.6MB
- SHA256 eb6a4e6fc95eb861eb3c773fcdf491fef667f011df497f790a983e5d5d098e84
- MD5 8bc01fb257a765e903507c14c96d810e
- SHA1 f5294671ad0754d4efa805ea3dee95f0f7f72980
- SHA512 37c21003c320d85599d6e91f17114b95b0d49cdcd3a4cbf7ff822efb6a136ff950fba4acf6661a9f1246fdeca0bf0a69e367396debedfbfda743a64a96f5fa10
- SSDEEP 393216:el35CAC9Ni5hzScA99Z3x0OWgm/jXsAy2GgyH0BzSbuvZR+ltxbSVtHj19K8kZs4:ypVmc7jcAJGgyHBeZMXbSLHj1M8ks4
- TLSH T15627333BF18BA53EE06A2A357973A210483B7A70A5068C52D6DCF44CCF664711E3EB57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger