Overview

overview

8

Static

static

2c315cd3cb...e9.exe

windows7-x64

8

2c315cd3cb...e9.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2c315cd3cb901a7e244028e9b2eada6fde94380a7365d242ee797e642b80e2e9

  • Size

    304KB

  • Sample

    221106-m9189sghc3

  • MD5

    25d54c481ce3974a5364855a3218dd87

  • SHA1

    f459585b93b1ec37742b48d50e194b37975026a0

  • SHA256

    2c315cd3cb901a7e244028e9b2eada6fde94380a7365d242ee797e642b80e2e9

  • SHA512

    bc92bb05fb764bf05ef48bb05a2aaa05a2a40a744b5ba5f209d10f8b5d57d2eeb4feb0715b82795a441a5826248672963c16880a806b7c37ea104f3f880aa0e4

  • SSDEEP

    3072:ZIDNcIFN3tw4QfwmAOMe6UJbVM/vkA9OQzY6eCFs5Juh2v19hlDcfbEdp7uxEo+i:qJigOTJXYOaFs5Juh819hqkuGh2LeyI

Score
8/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      2c315cd3cb901a7e244028e9b2eada6fde94380a7365d242ee797e642b80e2e9

    • Size

      304KB

    • MD5

      25d54c481ce3974a5364855a3218dd87

    • SHA1

      f459585b93b1ec37742b48d50e194b37975026a0

    • SHA256

      2c315cd3cb901a7e244028e9b2eada6fde94380a7365d242ee797e642b80e2e9

    • SHA512

      bc92bb05fb764bf05ef48bb05a2aaa05a2a40a744b5ba5f209d10f8b5d57d2eeb4feb0715b82795a441a5826248672963c16880a806b7c37ea104f3f880aa0e4

    • SSDEEP

      3072:ZIDNcIFN3tw4QfwmAOMe6UJbVM/vkA9OQzY6eCFs5Juh2v19hlDcfbEdp7uxEo+i:qJigOTJXYOaFs5Juh819hqkuGh2LeyI

    Score
    8/10
    evasionpersistencetrojanupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks