Overview

overview

10

Static

static

358cde8d93...07.exe

windows7-x64

10

358cde8d93...07.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07

  • Size

    384KB

  • Sample

    221003-dg1btsegbq

  • MD5

    6aa10c7a5d6aecb4dfd09647f553dc62

  • SHA1

    798215e3f05eb7dda8dd0ec813681c176a0a9265

  • SHA256

    358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07

  • SHA512

    e212180568baeceda2181f506705a65f255736956cc26e1d80c224e7788b9cc1540943adbb2608ccfd99d7432e7d1d6a53c8dd81d26e949177caeb9b6c7641b9

  • SSDEEP

    6144:4JGK2pYLlY4c6ue7lfhTuJZrM4l8KONb6/SPcGHciKjyISzTOILNhWOmzTTKWiYy:EGK2pYLlY4c6ue7lfhTuJZrM4l8KONbq

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07

    • Size

      384KB

    • MD5

      6aa10c7a5d6aecb4dfd09647f553dc62

    • SHA1

      798215e3f05eb7dda8dd0ec813681c176a0a9265

    • SHA256

      358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07

    • SHA512

      e212180568baeceda2181f506705a65f255736956cc26e1d80c224e7788b9cc1540943adbb2608ccfd99d7432e7d1d6a53c8dd81d26e949177caeb9b6c7641b9

    • SSDEEP

      6144:4JGK2pYLlY4c6ue7lfhTuJZrM4l8KONb6/SPcGHciKjyISzTOILNhWOmzTTKWiYy:EGK2pYLlY4c6ue7lfhTuJZrM4l8KONbq

    Score
    10/10
    evasionpersistenceupx

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks