Overview

overview

8

Static

static

8

a232ba1c14...a8.exe

windows7-x64

8

a232ba1c14...a8.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    a232ba1c144aa09cd8c1d7f89f05daed823f28c4c76f204a297cdafbd7497fa8

  • Size

    600KB

  • Sample

    221003-a8nkkabbel

  • MD5

    71fe0255ce3eceb3456365e701de6240

  • SHA1

    831e8bceba92d30448d7b4aece353fb24a3c2ff2

  • SHA256

    a232ba1c144aa09cd8c1d7f89f05daed823f28c4c76f204a297cdafbd7497fa8

  • SHA512

    88eeefe2abc95355a177597876e4b0c5cec285f6bcddf12c53baaa2accfbf33bb538cafe099c9e4750be84d4f090411c5998504a42f4201e16a4ff9ced1a0da9

  • SSDEEP

    12288:2Y8mLbGtIbAEyxxHW+t9bAGuwNFKlbE7t6vc4H+jhuph6cuP:2YrCjQe9bBKQtWcRh+PuP

Score
8/10
persistencevmprotect

Malware Config

Targets

    • Target

      a232ba1c144aa09cd8c1d7f89f05daed823f28c4c76f204a297cdafbd7497fa8

    • Size

      600KB

    • MD5

      71fe0255ce3eceb3456365e701de6240

    • SHA1

      831e8bceba92d30448d7b4aece353fb24a3c2ff2

    • SHA256

      a232ba1c144aa09cd8c1d7f89f05daed823f28c4c76f204a297cdafbd7497fa8

    • SHA512

      88eeefe2abc95355a177597876e4b0c5cec285f6bcddf12c53baaa2accfbf33bb538cafe099c9e4750be84d4f090411c5998504a42f4201e16a4ff9ced1a0da9

    • SSDEEP

      12288:2Y8mLbGtIbAEyxxHW+t9bAGuwNFKlbE7t6vc4H+jhuph6cuP:2YrCjQe9bBKQtWcRh+PuP

    Score
    8/10
    vmprotectpersistence

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks