Overview

overview

8

Static

static

ac6ca6457d...d9.exe

windows7-x64

8

ac6ca6457d...d9.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    ac6ca6457df7344095b9ce47eb498f9ceab66c3c65979f3f4e9b29221a968ad9

  • Size

    45KB

  • Sample

    221002-psklasfbd7

  • MD5

    6d07f6d8fb91070736ae89d6c2b340a0

  • SHA1

    8c48eacc6a03190f57fd7166872cdf58c35f4f8c

  • SHA256

    ac6ca6457df7344095b9ce47eb498f9ceab66c3c65979f3f4e9b29221a968ad9

  • SHA512

    002a3f1f0eb412a64d46319be8f31c55f80843513a0b4c9e14ef02e9fef3ac67d580d10842b4d9fc9099737f0823505c5110b4112db9b4f743c6935140f75cc6

  • SSDEEP

    768:DChSWmqwtePNufNcNGxdhfXbZa2cZurJ7jBnzL3Fnw4HZoF:GhSWmqwgPIWaKZovlPFVZ

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      ac6ca6457df7344095b9ce47eb498f9ceab66c3c65979f3f4e9b29221a968ad9

    • Size

      45KB

    • MD5

      6d07f6d8fb91070736ae89d6c2b340a0

    • SHA1

      8c48eacc6a03190f57fd7166872cdf58c35f4f8c

    • SHA256

      ac6ca6457df7344095b9ce47eb498f9ceab66c3c65979f3f4e9b29221a968ad9

    • SHA512

      002a3f1f0eb412a64d46319be8f31c55f80843513a0b4c9e14ef02e9fef3ac67d580d10842b4d9fc9099737f0823505c5110b4112db9b4f743c6935140f75cc6

    • SSDEEP

      768:DChSWmqwtePNufNcNGxdhfXbZa2cZurJ7jBnzL3Fnw4HZoF:GhSWmqwgPIWaKZovlPFVZ

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks