bc02dd5c0e4302635b710406f5205accd84edcd4afafc9015659e56d2d27922e

General

Target

bc02dd5c0e4302635b710406f5205accd84edcd4afafc9015659e56d2d27922e
Size

471KB
Sample

221017-je7k1sbber
MD5

8bbaa9b32beb7f3aa730eba1a3459c87
SHA1

79a2702b73c18355e2ebb450d84afe89d1c0eba4
SHA256

bc02dd5c0e4302635b710406f5205accd84edcd4afafc9015659e56d2d27922e
SHA512

ea6ea9410d5e1fca96960aa897514c427e20186628cc22fbb54481e3d0983a6f8c33f430d5b4cb515ae369c4e9cd7514cdf94b63ed990feb6ab2721d0f294589
SSDEEP

6144:HBlY+32WWluqvHpVmXWEjFJRWci+WUd20rUU5EYCTvaBju4z2G2b2SA:HUnWwvHpVmXpjJIUd2cUusvalxzBY9A

Score

10^/10

Malware Config

Targets

- Target
  
  bc02dd5c0e4302635b710406f5205accd84edcd4afafc9015659e56d2d27922e
- Size
  
  471KB
- MD5
  
  8bbaa9b32beb7f3aa730eba1a3459c87
- SHA1
  
  79a2702b73c18355e2ebb450d84afe89d1c0eba4
- SHA256
  
  bc02dd5c0e4302635b710406f5205accd84edcd4afafc9015659e56d2d27922e
- SHA512
  
  ea6ea9410d5e1fca96960aa897514c427e20186628cc22fbb54481e3d0983a6f8c33f430d5b4cb515ae369c4e9cd7514cdf94b63ed990feb6ab2721d0f294589
- SSDEEP
  
  6144:HBlY+32WWluqvHpVmXWEjFJRWci+WUd20rUU5EYCTvaBju4z2G2b2SA:HUnWwvHpVmXpjJIUd2cUusvalxzBY9A
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies system executable filetype association
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2