Overview

overview

8

Static

static

8

message.scr

windows7-x64

8

message.scr

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    593963758c1c184335b9116f0f2eac6b

  • Size

    179KB

  • Sample

    221011-zlagvsdgfn

  • MD5

    593963758c1c184335b9116f0f2eac6b

  • SHA1

    76f4a4ca93c2c8ba96baa7272ea381c499dbe3bb

  • SHA256

    8e65513d2938dcb043d8fe3ba31856f3d85346adf3273ea0ef516d0b495efe2d

  • SHA512

    fdf2bf515dc1a5aa3f8761e6dc7177e516eacc12bc7c195b3876ef633ed090df65d1e9f12c1dca27e6572052ad68cda582603a268cc745b607ccf5a6b94c6a03

  • SSDEEP

    3072:AJNx/F0VGuhBYyIWMOeJhA2yOBGhGKMtIZaXQqrDFmwJibZceHkIox8iZz5uNn:AaBD45JK2yKGhGqZWDFbJiMxTZQNn

Score
8/10
aspackv2persistence

Malware Config

Targets

    • Target

      message.scr

    • Size

      127KB

    • MD5

      d0486bc4d182c72be41602b5b5f1da91

    • SHA1

      16193e1e15b20510216109b6f530682bea256bb8

    • SHA256

      92173b985f9d4c36dd440fbaa42dd2d9633b0dde4ef30a0639fb591503fd50df

    • SHA512

      3498887338971fa83a1ed0d6f4921e288a3d347b93c17b4de2ee1f5d6ac8344a93340cb1268d53fcd0cd43e3dc7bc5e75698a807197608dad2a95433100ae7a4

    • SSDEEP

      3072:LpDBAKMk0gAN4lgOjCFQ2nf6bdtUNhomcN:LfMPgwIyNSb/Yho

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks