General
- Target acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712
- Size 1.1MB
- Sample260506-ewxd6aev2j
- SHA256 acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712
- MD5 267f48e174bdbece4235cf200dfc2503
- SHA1 5bd82a88950e029312bcf55b1bb6528fe96a3046
- SHA512 59707d95c00a96cb378aa5f4c9e2d883acab12a976db6bb0fa4c6550c0b981cee341f361cef22eea9b6f70106dfd4cd541d13b55ed30b236570990cef6727e58
- SSDEEP 24576:60/bFJZqJXG4wSyhFYyw6fSfKYa2pnfkT+oCm1wzdPsCKlCnQ+dJGeP:hZqVBwS9ywfKYD86oCmyzdPsNCn3n
- TLSH T1D2453376E20548CCBF9DC5BF69C4B15ED3B66650A14C47E6F4B2DA1B512C09ACDC3E20
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Targets
-
- Target acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712
- Size 1.1MB
- SHA256 acca258713692d82ea4b9bdf72dfa6dadc65083b1d37828bac0d2e6af6ba1712
- MD5 267f48e174bdbece4235cf200dfc2503
- SHA1 5bd82a88950e029312bcf55b1bb6528fe96a3046
- SHA512 59707d95c00a96cb378aa5f4c9e2d883acab12a976db6bb0fa4c6550c0b981cee341f361cef22eea9b6f70106dfd4cd541d13b55ed30b236570990cef6727e58
- SSDEEP 24576:60/bFJZqJXG4wSyhFYyw6fSfKYa2pnfkT+oCm1wzdPsCKlCnQ+dJGeP:hZqVBwS9ywfKYD86oCmyzdPsNCn3n
- TLSH T1D2453376E20548CCBF9DC5BF69C4B15ED3B66650A14C47E6F4B2DA1B512C09ACDC3E20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Family: valleyrat
-
https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.