Overview

overview

8

Static

static

8

5d9461c16f...ad.exe

windows7-x64

8

5d9461c16f...ad.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    5d9461c16fbe4b7e7fb7142505b0f738ab3e1fe93c4b762e3a96f55c023217ad

  • Size

    22KB

  • Sample

    221004-g1l54afden

  • MD5

    487d8f023a1ece2cc88098fd219f0a40

  • SHA1

    6b6d8eb7f62682337654b86a56382c1cb2a857aa

  • SHA256

    5d9461c16fbe4b7e7fb7142505b0f738ab3e1fe93c4b762e3a96f55c023217ad

  • SHA512

    058798c6f380dee48302e5c820078a55f34bc745a384b28823c72ca062671e70ead3f12ba3cecffed6a836bac552e599af9aeda602941a0d8978e0e5daf44d94

  • SSDEEP

    384:dykBpbi8bcji30d1BCT/ob/xDbH580i02Jd+mSd+2Fo6zE:Mka+3sCT4ju0i0++E2+6z

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      5d9461c16fbe4b7e7fb7142505b0f738ab3e1fe93c4b762e3a96f55c023217ad

    • Size

      22KB

    • MD5

      487d8f023a1ece2cc88098fd219f0a40

    • SHA1

      6b6d8eb7f62682337654b86a56382c1cb2a857aa

    • SHA256

      5d9461c16fbe4b7e7fb7142505b0f738ab3e1fe93c4b762e3a96f55c023217ad

    • SHA512

      058798c6f380dee48302e5c820078a55f34bc745a384b28823c72ca062671e70ead3f12ba3cecffed6a836bac552e599af9aeda602941a0d8978e0e5daf44d94

    • SSDEEP

      384:dykBpbi8bcji30d1BCT/ob/xDbH580i02Jd+mSd+2Fo6zE:Mka+3sCT4ju0i0++E2+6z

    Score
    8/10
    persistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks