6ad6229dbc0441fe2a161c48a3a9f894c94ff85485cd0afe91e7cc283e14aa87 | Triage

Submit
Reports

Overview

overview

Static

static

8

6ad6229dbc...87.exe

windows7-x64

6ad6229dbc...87.exe

windows10-2004-x64

Sharing

General

Target

6ad6229dbc0441fe2a161c48a3a9f894c94ff85485cd0afe91e7cc283e14aa87
Size

96KB
Sample

221011-b87h4saaar
MD5

68841df59f4a8022ebbb6f6328b6761a
SHA1

13814fafc8aed680993595aee006619fb6ea860b
SHA256

6ad6229dbc0441fe2a161c48a3a9f894c94ff85485cd0afe91e7cc283e14aa87
SHA512

ec9c4b95521aeeda5464ea1158f7a504dd7a2df4f25ec5dbef794934eb16a76cf561c82c155e8ef80fee340073cbf91bb59ee7bbccb8b129c5d0f58672ecc5fd
SSDEEP

1536:vW9vZKK1YJlA5l6oRC5Uobc5qu/H94VNUBemLJm9a65iD7Kwtz2pXQQyq:OqDJlQl69j6qwuXMeMm9a65ixtztQyq

Score

10^/10

evasion trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

6ad6229dbc0441fe2a161c48a3a9f894c94ff85485cd0afe91e7cc283e14aa87.exe

Resource

win7-20220812-en

evasion trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

6ad6229dbc0441fe2a161c48a3a9f894c94ff85485cd0afe91e7cc283e14aa87.exe

Resource

win10v2004-20220901-en

evasion trojan upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  6ad6229dbc0441fe2a161c48a3a9f894c94ff85485cd0afe91e7cc283e14aa87
- Size
  
  96KB
- MD5
  
  68841df59f4a8022ebbb6f6328b6761a
- SHA1
  
  13814fafc8aed680993595aee006619fb6ea860b
- SHA256
  
  6ad6229dbc0441fe2a161c48a3a9f894c94ff85485cd0afe91e7cc283e14aa87
- SHA512
  
  ec9c4b95521aeeda5464ea1158f7a504dd7a2df4f25ec5dbef794934eb16a76cf561c82c155e8ef80fee340073cbf91bb59ee7bbccb8b129c5d0f58672ecc5fd
- SSDEEP
  
  1536:vW9vZKK1YJlA5l6oRC5Uobc5qu/H94VNUBemLJm9a65iD7Kwtz2pXQQyq:OqDJlQl69j6qwuXMeMm9a65ixtztQyq
Score

10^/10

evasion trojan upx
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasiontrojanupx

behavioral2

evasiontrojanupx

© 2018-2025

Terms | Privacy