Overview

overview

10

Static

static

10

ff1bc03baf...03.exe

windows7-x64

10

ff1bc03baf...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff1bc03bafef8dedaa9487f0ae971ff1a7b44919de195f303a055014b92e0203

  • Size

    934KB

  • Sample

    221121-stkt8sah3y

  • MD5

    27dd86918eb6c0d362577732a3d91640

  • SHA1

    0584a7a02af0e60ae0b227d61ff1efd78687afb5

  • SHA256

    ff1bc03bafef8dedaa9487f0ae971ff1a7b44919de195f303a055014b92e0203

  • SHA512

    fd659ebf30bfdd1cfcd8bff1b30674de9e05b50a3d14744114acd7ca6538b4a599ccea09809349ec1b45d3bc98efb60ebe5e992c032e05397f8a388a16f4fd15

  • SSDEEP

    24576:w4Z/TzBDwdltwdltwdltwdltwdltwdltwdltwdltwdltwdltwdllwdls:w4QeeeeeeeeeeWs

Score
10/10
neshtadiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      ff1bc03bafef8dedaa9487f0ae971ff1a7b44919de195f303a055014b92e0203

    • Size

      934KB

    • MD5

      27dd86918eb6c0d362577732a3d91640

    • SHA1

      0584a7a02af0e60ae0b227d61ff1efd78687afb5

    • SHA256

      ff1bc03bafef8dedaa9487f0ae971ff1a7b44919de195f303a055014b92e0203

    • SHA512

      fd659ebf30bfdd1cfcd8bff1b30674de9e05b50a3d14744114acd7ca6538b4a599ccea09809349ec1b45d3bc98efb60ebe5e992c032e05397f8a388a16f4fd15

    • SSDEEP

      24576:w4Z/TzBDwdltwdltwdltwdltwdltwdltwdltwdltwdltwdltwdllwdls:w4QeeeeeeeeeeWs

    Score
    10/10
    discoveryevasionpersistencetrojanupx

    • UAC bypass

      evasiontrojan

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks