Overview

overview

8

Static

static

fb720bcafd...75.exe

windows7-x64

8

fb720bcafd...75.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    fb720bcafdc55cd1eeba0d49fcec25b62646b5a34e7d5df5393dd1f8f5b7f075

  • Size

    304KB

  • Sample

    221106-m9rptsbccl

  • MD5

    22738589e57d58884a898a5a70324d04

  • SHA1

    ceec83a496cac695bd2b9d2504c9c510fba0e984

  • SHA256

    fb720bcafdc55cd1eeba0d49fcec25b62646b5a34e7d5df5393dd1f8f5b7f075

  • SHA512

    a82975292b43292b9bfc0f0d03f31370f72f557a295d9953f8d45449b6d1bd8474c454523510349dfb0c7aa58969662c4cc0fac021783b8d82f144202d36aa69

  • SSDEEP

    3072:ZIDNcIFN3tw4QfwmAOMe6UJbVM/vkA9OQzY6eCFs5Juh2v19hlDcfbEdp7uxEo+i:qJigOTJXYOaFs5Juh819hqkuGh2LeyI

Score
8/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      fb720bcafdc55cd1eeba0d49fcec25b62646b5a34e7d5df5393dd1f8f5b7f075

    • Size

      304KB

    • MD5

      22738589e57d58884a898a5a70324d04

    • SHA1

      ceec83a496cac695bd2b9d2504c9c510fba0e984

    • SHA256

      fb720bcafdc55cd1eeba0d49fcec25b62646b5a34e7d5df5393dd1f8f5b7f075

    • SHA512

      a82975292b43292b9bfc0f0d03f31370f72f557a295d9953f8d45449b6d1bd8474c454523510349dfb0c7aa58969662c4cc0fac021783b8d82f144202d36aa69

    • SSDEEP

      3072:ZIDNcIFN3tw4QfwmAOMe6UJbVM/vkA9OQzY6eCFs5Juh2v19hlDcfbEdp7uxEo+i:qJigOTJXYOaFs5Juh819hqkuGh2LeyI

    Score
    8/10
    evasionpersistencetrojanupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks