811d6bc29223b3be6f9255f5cce649b1960f2e7be747a0381304c39dd2dd7da9

General

Target

811d6bc29223b3be6f9255f5cce649b1960f2e7be747a0381304c39dd2dd7da9
Size

658KB
Sample

221124-bj6khscd7v
MD5

2cd0d704b3e9dcacf36fc2aaf6ade830
SHA1

0249904537f633cca469da2546abebcbbbef0418
SHA256

811d6bc29223b3be6f9255f5cce649b1960f2e7be747a0381304c39dd2dd7da9
SHA512

508ba5545455071733dba7349ffc1d28ba84667cb1736a5246d2ca80678386fa5c2f899f9cf1a10150f3f99d0b6748cea69990daa4ce8e3113c9c72e386f49ca
SSDEEP

12288:9HuEA5r6cRuqkN530xuooqMVwsg32MExtD:9HuEA5r6G030x+gBEDD

Score

9^/10

Malware Config

Targets

- Target
  
  811d6bc29223b3be6f9255f5cce649b1960f2e7be747a0381304c39dd2dd7da9
- Size
  
  658KB
- MD5
  
  2cd0d704b3e9dcacf36fc2aaf6ade830
- SHA1
  
  0249904537f633cca469da2546abebcbbbef0418
- SHA256
  
  811d6bc29223b3be6f9255f5cce649b1960f2e7be747a0381304c39dd2dd7da9
- SHA512
  
  508ba5545455071733dba7349ffc1d28ba84667cb1736a5246d2ca80678386fa5c2f899f9cf1a10150f3f99d0b6748cea69990daa4ce8e3113c9c72e386f49ca
- SSDEEP
  
  12288:9HuEA5r6cRuqkN530xuooqMVwsg32MExtD:9HuEA5r6G030x+gBEDD
Score

9^/10

evasion persistence trojan upx
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Adds policy Run key to start application
  persistence
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Modifies AppInit DLL entries
  persistence
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2