Extracted

Extracted

• • Target
    e825565216f6397a04fde97547b5f106.exe
  • Size 24KB
  • SHA256 7e0039e89e08c86ef23875cc3abb955184c389bd51f491218da2fce7b824bdcf
  • MD5 e825565216f6397a04fde97547b5f106
  • SHA1 c7d3eac92ba99c9b2787ed4245e633d708b3603d
  • SHA512 7bc81b48b1425c513fda4db48989bbd5f63a0dc9a13764b1054bdce3d846f1d47986fe95af1992b0c65072cd6874ef88e246c8f52b9dec818a9c18c4259b07dc
  • MD5 SHA1 SHA512

  Score

  10^/10

  suricatapersistence

  • suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

    suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata

  • Blocklisted process makes network request

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2