Overview

overview

10

Static

static

8

a5523460c9...9e.exe

windows7-x64

10

a5523460c9...9e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a5523460c9d40b6b75d716b79f3b083b423520ed20cfcd4ab77b764883ec369e

  • Size

    571KB

  • Sample

    221020-crvnnaaca2

  • MD5

    4b532ab6ad5e4799af47f268acfd3eb6

  • SHA1

    aab4b0f133c5c2171b383b33c0e70ee25c1a336f

  • SHA256

    a5523460c9d40b6b75d716b79f3b083b423520ed20cfcd4ab77b764883ec369e

  • SHA512

    5c03ad29d42a0ee95f5a744611500e060ea5f6f402747e9fdb217aa09ed5e1ece7ea0ed5702c7c9d3c39bb44466a1222ddf527efaf749f8834502f8e60c9bb86

  • SSDEEP

    12288:1jkArEN249AyE/rbaMct4bO2/VIEdWn4IUqhfU153utrK9pVQl+LWm/9r:KFE//Tct4bOsObg+Y9pVXz/9r

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      a5523460c9d40b6b75d716b79f3b083b423520ed20cfcd4ab77b764883ec369e

    • Size

      571KB

    • MD5

      4b532ab6ad5e4799af47f268acfd3eb6

    • SHA1

      aab4b0f133c5c2171b383b33c0e70ee25c1a336f

    • SHA256

      a5523460c9d40b6b75d716b79f3b083b423520ed20cfcd4ab77b764883ec369e

    • SHA512

      5c03ad29d42a0ee95f5a744611500e060ea5f6f402747e9fdb217aa09ed5e1ece7ea0ed5702c7c9d3c39bb44466a1222ddf527efaf749f8834502f8e60c9bb86

    • SSDEEP

      12288:1jkArEN249AyE/rbaMct4bO2/VIEdWn4IUqhfU153utrK9pVQl+LWm/9r:KFE//Tct4bOsObg+Y9pVXz/9r

    Score
    10/10
    evasionpersistencetrojanupx

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks