General
-
Target
e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609
-
Size
1.6MB
-
Sample
220520-d4ba8afhc7
-
MD5
be0f8e6d545ddc8c2cfedb76ad965a19
-
SHA1
37fbc96b83ad23e9d8102351c18944e58450f927
-
SHA256
e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609
-
SHA512
cb7619971f232c4976b8cdd8cb3116a981e1b5433a87fffdda74880e6b29f9d7fc32bc1f30bb425ee000af6a48cc982ede2e693976631cd4fc989daa048c3589
Malware Config
Targets
-
-
Target
e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609
-
Size
1.6MB
-
MD5
be0f8e6d545ddc8c2cfedb76ad965a19
-
SHA1
37fbc96b83ad23e9d8102351c18944e58450f927
-
SHA256
e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609
-
SHA512
cb7619971f232c4976b8cdd8cb3116a981e1b5433a87fffdda74880e6b29f9d7fc32bc1f30bb425ee000af6a48cc982ede2e693976631cd4fc989daa048c3589
Score10/10-
Modifies system executable filetype association
-
Registers COM server for autorun
-
suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Sets file execution options in registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-