Overview

overview

10

Static

static

ff72b295de...f1.exe

windows7_x64

10

ff72b295de...f1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff72b295ded9889cee24320db368bcf1

  • Size

    809KB

  • Sample

    220518-14z1xahedr

  • MD5

    ff72b295ded9889cee24320db368bcf1

  • SHA1

    5d7991f8495d56088710dd558faba639ffd05292

  • SHA256

    e54ccfd9a2ab15b4461eb38baec21eb828f7757ca3e67db3b7acb261be34adcd

  • SHA512

    37ab209741e90c78565d170ab48d7ee83c8633e93e646a4c8f639c305c8b6528841668b6aa7797870612d24e11e1ff1aaae0f5622e9a2195957f9142e93a7b1b

Score
10/10
persistencesuricata

Malware Config

Targets

    • Target

      ff72b295ded9889cee24320db368bcf1

    • Size

      809KB

    • MD5

      ff72b295ded9889cee24320db368bcf1

    • SHA1

      5d7991f8495d56088710dd558faba639ffd05292

    • SHA256

      e54ccfd9a2ab15b4461eb38baec21eb828f7757ca3e67db3b7acb261be34adcd

    • SHA512

      37ab209741e90c78565d170ab48d7ee83c8633e93e646a4c8f639c305c8b6528841668b6aa7797870612d24e11e1ff1aaae0f5622e9a2195957f9142e93a7b1b

    Score
    10/10
    persistencesuricata

    • suricata: ET MALWARE Generic AsyncRAT Style SSL Cert

      suricata: ET MALWARE Generic AsyncRAT Style SSL Cert

      suricata

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks