General
-
Target
niberius.dll
-
Size
268KB
-
Sample
210709-w87erj4br6
-
MD5
d22d8bb38cf8d6a5ce6d8be4106350e7
-
SHA1
02fc51e6572a17f5dbbc32c4e3dd03cca3c51afe
-
SHA256
4dc9d5ee1debdba0388fbb112d4bbbc01bb782f015e798cced3fc2edb17ac557
-
SHA512
434e6b553bb96c5ae6b26d22cc35614f248f93a442e702395ce925578598bdf74eb884daf5a40d6c02cb1769eaf3dfdf858205e0c7b64f8afda38574991fcc41
Static task
static1
Behavioral task
behavioral1
Sample
niberius.dll
Resource
win7v20210408
Behavioral task
behavioral2
Sample
niberius.dll
Resource
win10v20210410
Malware Config
Extracted
hancitor
0707_wvcr
http://sudepallon.com/8/forum.php
http://anspossthrly.ru/8/forum.php
http://thentabecon.ru/8/forum.php
Extracted
fickerstealer
pospvisis.com:80
Targets
-
-
Target
niberius.dll
-
Size
268KB
-
MD5
d22d8bb38cf8d6a5ce6d8be4106350e7
-
SHA1
02fc51e6572a17f5dbbc32c4e3dd03cca3c51afe
-
SHA256
4dc9d5ee1debdba0388fbb112d4bbbc01bb782f015e798cced3fc2edb17ac557
-
SHA512
434e6b553bb96c5ae6b26d22cc35614f248f93a442e702395ce925578598bdf74eb884daf5a40d6c02cb1769eaf3dfdf858205e0c7b64f8afda38574991fcc41
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-