Overview

overview

10

Static

static

10

7a7fafaddf...15.exe

windows7-x64

1

7a7fafaddf...15.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7a7fafaddf2a068b147074194854e0f4964a0ca0385612929c6b0f27d1f77215

  • Size

    180KB

  • Sample

    221020-1q6xasgbf6

  • MD5

    a019e421bb952a5124a7df2f7e444974

  • SHA1

    7ec3bd0d9232c21ae01c953832b84fcf5a11e73e

  • SHA256

    7a7fafaddf2a068b147074194854e0f4964a0ca0385612929c6b0f27d1f77215

  • SHA512

    1124dc9f9f69b7d44c8e9c2f773f379e2847bfd9effbe5ec5367bfd041eedd666c381da60fd2e923d3f332eb5db339c89593f7a003bb593978bb4bb2721bdc98

  • SSDEEP

    3072:UxiYwPo9MtNetCAZIZiwGnLXndHVc+8dstVwurByIaCfbiPofX7nLGYZ9ksO4SE/:Uxipg94NGsZCe+8dstVwudyIaM+PSXf5

Score
10/10
modiloaderevasionpersistenceupx

Malware Config

Targets

    • Target

      7a7fafaddf2a068b147074194854e0f4964a0ca0385612929c6b0f27d1f77215

    • Size

      180KB

    • MD5

      a019e421bb952a5124a7df2f7e444974

    • SHA1

      7ec3bd0d9232c21ae01c953832b84fcf5a11e73e

    • SHA256

      7a7fafaddf2a068b147074194854e0f4964a0ca0385612929c6b0f27d1f77215

    • SHA512

      1124dc9f9f69b7d44c8e9c2f773f379e2847bfd9effbe5ec5367bfd041eedd666c381da60fd2e923d3f332eb5db339c89593f7a003bb593978bb4bb2721bdc98

    • SSDEEP

      3072:UxiYwPo9MtNetCAZIZiwGnLXndHVc+8dstVwurByIaCfbiPofX7nLGYZ9ksO4SE/:Uxipg94NGsZCe+8dstVwudyIaM+PSXf5

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Disables Task Manager via registry modification

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks