Overview

overview

10

Static

static

8

cfbfe562aa...7b.exe

windows7-x64

10

cfbfe562aa...7b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cfbfe562aae9179bfa9d6cfca07bc277ec48ec035b72b27fec7f49b4ca14657b

  • Size

    268KB

  • Sample

    221106-d6yvasahg7

  • MD5

    0a0e57a0fe628df8be4a06a46b345ff6

  • SHA1

    b17ba3d3b1ca1a66f6ea3e934e22941f5a1b2be2

  • SHA256

    cfbfe562aae9179bfa9d6cfca07bc277ec48ec035b72b27fec7f49b4ca14657b

  • SHA512

    11ebd455c1d04545ca3da4cf4407d1b71c52389f5535abeca874aad74cee8eaf6b9d0f736a5f8780b462e7a89568b8fff5e37cf42b5f760a59dd65df533cdcfd

  • SSDEEP

    6144:XbfO3SlNyTkyhlx0kRujRYO4VYAtHJ3DFLjxIE++/gAxcbibMoSN:LfIST8kk0kMlCPTvXxKXoSN

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      cfbfe562aae9179bfa9d6cfca07bc277ec48ec035b72b27fec7f49b4ca14657b

    • Size

      268KB

    • MD5

      0a0e57a0fe628df8be4a06a46b345ff6

    • SHA1

      b17ba3d3b1ca1a66f6ea3e934e22941f5a1b2be2

    • SHA256

      cfbfe562aae9179bfa9d6cfca07bc277ec48ec035b72b27fec7f49b4ca14657b

    • SHA512

      11ebd455c1d04545ca3da4cf4407d1b71c52389f5535abeca874aad74cee8eaf6b9d0f736a5f8780b462e7a89568b8fff5e37cf42b5f760a59dd65df533cdcfd

    • SSDEEP

      6144:XbfO3SlNyTkyhlx0kRujRYO4VYAtHJ3DFLjxIE++/gAxcbibMoSN:LfIST8kk0kMlCPTvXxKXoSN

    Score
    10/10
    evasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks