Overview

overview

8

Static

static

UD_PO_000681.exe

windows7_x64

8

UD_PO_000681.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UD_PO_000681.exe

  • Size

    483KB

  • Sample

    200708-mwytbc1ha2

  • MD5

    24a8d8c071bbb496ba8e64e7817fd6c9

  • SHA1

    f40194270a9475aeb044a062bd7ef9376d8ed857

  • SHA256

    c890bc2e899bdb9c2a7cbe9ab52b852c5ea6832e44615f2afc66ab47925866d2

  • SHA512

    c4dcbb0b0fdc7469c6e5abc038867f3c65e179a3692dc884d7713db20c2fdefb4f96d5369210aedf807008cbe3821b05fb2a162c45a603aa0c68d56962d4e9a0

Score
8/10
persistence

Malware Config

Targets

    • Target

      UD_PO_000681.exe

    • Size

      483KB

    • MD5

      24a8d8c071bbb496ba8e64e7817fd6c9

    • SHA1

      f40194270a9475aeb044a062bd7ef9376d8ed857

    • SHA256

      c890bc2e899bdb9c2a7cbe9ab52b852c5ea6832e44615f2afc66ab47925866d2

    • SHA512

      c4dcbb0b0fdc7469c6e5abc038867f3c65e179a3692dc884d7713db20c2fdefb4f96d5369210aedf807008cbe3821b05fb2a162c45a603aa0c68d56962d4e9a0

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks