Extracted

• • Target

    7f759491e3d656b5d181737caacee34d0857c92e63ed46ab3028dc7b685e54bd

  • Size

    213KB

  • MD5

    53a8df6c18f41e9ca1200fd939b811c6

  • SHA1

    1c241d37b526e7648b468b37755d69f8d9f9033f

  • SHA256

    7f759491e3d656b5d181737caacee34d0857c92e63ed46ab3028dc7b685e54bd

  • SHA512

    017feb51ab561457949ef2e8472cfc64f9f6f7404de49afa60eee4a9d2c590b5745bf081ad2fd6799b6084b449633bd007d72e4bbd362e6d88f2610f0d7c44f3

  • SSDEEP

    6144:tTfFDbRnOTrt5J1FwvAL/1r8Ng5R3ZD/HtMiCbnQQ:D5OnFCAL/1gubJD/Nnsj

  Score

  10^/10

  aspackv2persistenceupx

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2