65a869bfaf697958122a9f2c9754f20f8e8ba8509ab87c76f370154df919ffdf

General

Target

65a869bfaf697958122a9f2c9754f20f8e8ba8509ab87c76f370154df919ffdf
Size

324KB
Sample

221003-d92qcseff9
MD5

5f1a899ba6c831657f6f77c545280ad0
SHA1

9daa6d5c70ff0c68e41cfac06dd6eca41a376933
SHA256

65a869bfaf697958122a9f2c9754f20f8e8ba8509ab87c76f370154df919ffdf
SHA512

350c023c8357daf8f153afae96ac78ac7aaf0ca6d02b48e0aac151dacf48a1f157349a790618892c95c47a8e32b92c2e001fa5bc842a53f066edebe87a8a2e34
SSDEEP

6144:KlZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lBSvvazbue:KHLUMuiv9RgfSjAzRtyBN

Score

10^/10

Malware Config

Targets

- Target
  
  65a869bfaf697958122a9f2c9754f20f8e8ba8509ab87c76f370154df919ffdf
- Size
  
  324KB
- MD5
  
  5f1a899ba6c831657f6f77c545280ad0
- SHA1
  
  9daa6d5c70ff0c68e41cfac06dd6eca41a376933
- SHA256
  
  65a869bfaf697958122a9f2c9754f20f8e8ba8509ab87c76f370154df919ffdf
- SHA512
  
  350c023c8357daf8f153afae96ac78ac7aaf0ca6d02b48e0aac151dacf48a1f157349a790618892c95c47a8e32b92c2e001fa5bc842a53f066edebe87a8a2e34
- SSDEEP
  
  6144:KlZ/zUMu4pDSxsCMRzf7x3SfS1JAzXBtL76lBSvvazbue:KHLUMuiv9RgfSjAzRtyBN
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2