Overview

overview

10

Static

static

7dab5d5e99...7e.exe

windows7-x64

10

7dab5d5e99...7e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7dab5d5e9906c5733a3e78430d91e20b1e7ec5ba6331044cf1a022b36427d87e

  • Size

    464KB

  • Sample

    221020-2gc4ashchr

  • MD5

    2677cf4894ab9faf9172957bd3eb32d3

  • SHA1

    2cc9dced018036e474bcef7ce15d5d5935437483

  • SHA256

    7dab5d5e9906c5733a3e78430d91e20b1e7ec5ba6331044cf1a022b36427d87e

  • SHA512

    733e01a2320c2fff5ed4265ed60d0f00420609e9df1a2e270240a5313bce130cd2f1020839a294e2a8076bfeac5961688993b2af8f68ccf634face1ac444b005

  • SSDEEP

    12288:Pm1swDeuL4pmCFYryv2RLfgdHc6bImhp5B6G0:PGswDhYuyv2LYd8sIkprJ

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      7dab5d5e9906c5733a3e78430d91e20b1e7ec5ba6331044cf1a022b36427d87e

    • Size

      464KB

    • MD5

      2677cf4894ab9faf9172957bd3eb32d3

    • SHA1

      2cc9dced018036e474bcef7ce15d5d5935437483

    • SHA256

      7dab5d5e9906c5733a3e78430d91e20b1e7ec5ba6331044cf1a022b36427d87e

    • SHA512

      733e01a2320c2fff5ed4265ed60d0f00420609e9df1a2e270240a5313bce130cd2f1020839a294e2a8076bfeac5961688993b2af8f68ccf634face1ac444b005

    • SSDEEP

      12288:Pm1swDeuL4pmCFYryv2RLfgdHc6bImhp5B6G0:PGswDhYuyv2LYd8sIkprJ

    Score
    10/10
    evasionpersistenceupx

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks