Overview

overview

8

Static

static

8

d494986f64...b8.exe

windows7-x64

8

d494986f64...b8.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    d494986f648833a1776f3390aafcd4db92e029d5b41d8183c359fd2561564ab8

  • Size

    437KB

  • Sample

    221121-l4f6gaeb48

  • MD5

    034d90f7cb1d8bb7c1d6c9a637ac3010

  • SHA1

    87010b72d5c55a54bd12f4f8d73246371948de0e

  • SHA256

    d494986f648833a1776f3390aafcd4db92e029d5b41d8183c359fd2561564ab8

  • SHA512

    d85d571ab0c1af6009580a3b622c81cb78c4fe12f455e7b6f202f91af1b65c01137547823f3304ce30b9b809c6fb2b48ab83480bfcbc2235aa6a017e159c53ab

  • SSDEEP

    6144:yPf6dj7skVzhkFwQ+J+k7R3eHy9Qo73FxIzLMgS7VUYdQ+FgxEa7RJYG/pj/gFAH:bpskBhcTK17BvbFWzmDdsEa4oge

Score
8/10
aspackv2evasionpersistenceupx

Malware Config

Targets

    • Target

      d494986f648833a1776f3390aafcd4db92e029d5b41d8183c359fd2561564ab8

    • Size

      437KB

    • MD5

      034d90f7cb1d8bb7c1d6c9a637ac3010

    • SHA1

      87010b72d5c55a54bd12f4f8d73246371948de0e

    • SHA256

      d494986f648833a1776f3390aafcd4db92e029d5b41d8183c359fd2561564ab8

    • SHA512

      d85d571ab0c1af6009580a3b622c81cb78c4fe12f455e7b6f202f91af1b65c01137547823f3304ce30b9b809c6fb2b48ab83480bfcbc2235aa6a017e159c53ab

    • SSDEEP

      6144:yPf6dj7skVzhkFwQ+J+k7R3eHy9Qo73FxIzLMgS7VUYdQ+FgxEa7RJYG/pj/gFAH:bpskBhcTK17BvbFWzmDdsEa4oge

    Score
    8/10
    aspackv2evasionpersistenceupx

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks