Overview

overview

8

Static

static

CF߱Ѫ�...se.exe

windows7-x64

8

CF߱Ѫ�...se.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d22f7d73778ef7a9421c94e25ee930f834f00f1f312c118b7c336ea5b6a215b1

  • Size

    1.9MB

  • Sample

    221123-s96fwage6s

  • MD5

    a5536d33dc7ec37c41570f9d300c816e

  • SHA1

    061363e23040bd4a348edfc5726cd708f2bb2cdc

  • SHA256

    d22f7d73778ef7a9421c94e25ee930f834f00f1f312c118b7c336ea5b6a215b1

  • SHA512

    14647d44a9fa3fa9f5ea3ea5bcb10b13a6e3c51e48b0082b6f0d72d80c17b3f6d4b68ae2de5b0659a6415b3a9d370fa4daa7202216f8f6ad7488a204a3abb04a

  • SSDEEP

    49152:wREtEMQJ8kZx802GPpfZ/Npshesu265LidLR5:wREtEMYqGxfZ/NcuJyt5

Score
8/10
persistence

Malware Config

Targets

    • Target

      CF߱Ѫٷµͼ͸_se.exe

    • Size

      2.0MB

    • MD5

      1a163ebbf2a240dd8d14e428ccb8583e

    • SHA1

      5a7166d8d93c5d30fa5cc07a4934716dedacd376

    • SHA256

      09b1d389f22f1f4ad96eef137a8dca0d337bc906732ae0e3877fdcea17b4ea25

    • SHA512

      b1553f637da1187411f9e27fc46f98b3ae6866846b655e9d80ace6a8a661183fdb82e1568805ef6c08ec7ac34c8f635e9ff7706f55985d4bbad5b47b7575871e

    • SSDEEP

      49152:6V/Rwt6wwRI2RxKmITTnsStgCX/TeUqXCQxRWo48E:6NRwt6wUy/nsStg2/ytWo48E

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks