Overview

overview

9

Static

static

8

e54901201f...96.exe

windows7-x64

9

e54901201f...96.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    e54901201fb22b0e0013d3d192a699c61a256c5e1f1e1ccdf66551e12a40cc96

  • Size

    92KB

  • Sample

    221106-tshh6aahg2

  • MD5

    0e3d11fd568f0245cd1afecb5bbad560

  • SHA1

    37e866315e347d7368765ca827118a3cacfe7897

  • SHA256

    e54901201fb22b0e0013d3d192a699c61a256c5e1f1e1ccdf66551e12a40cc96

  • SHA512

    c6e19ad97428bd359b611dc0754e32d2979bce83682ddbdfe5a60cdff76aac19845b67e38c2415ea6e81fdac76740d59e40bf0d3ed2c527177851a00fe170112

  • SSDEEP

    1536:8/NIzTaJnhbWIP3UjIALjuUL8YjUWohkyo+5/XaCGsWWIpd/PRXe6NVIRrFWLAZX:8/qHaJMIPyK8QWeo+FK0AF86Niz

Score
9/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e54901201fb22b0e0013d3d192a699c61a256c5e1f1e1ccdf66551e12a40cc96

    • Size

      92KB

    • MD5

      0e3d11fd568f0245cd1afecb5bbad560

    • SHA1

      37e866315e347d7368765ca827118a3cacfe7897

    • SHA256

      e54901201fb22b0e0013d3d192a699c61a256c5e1f1e1ccdf66551e12a40cc96

    • SHA512

      c6e19ad97428bd359b611dc0754e32d2979bce83682ddbdfe5a60cdff76aac19845b67e38c2415ea6e81fdac76740d59e40bf0d3ed2c527177851a00fe170112

    • SSDEEP

      1536:8/NIzTaJnhbWIP3UjIALjuUL8YjUWohkyo+5/XaCGsWWIpd/PRXe6NVIRrFWLAZX:8/qHaJMIPyK8QWeo+FK0AF86Niz

    Score
    9/10
    evasionpersistencetrojanupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks