Overview

overview

8

Static

static

5b17ac7ea8...e7.exe

windows7-x64

8

5b17ac7ea8...e7.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b17ac7ea8e13f9e36270b2cea2ceb61636ce64bffdd40240eb081a90c97cde7

  • Size

    304KB

  • Sample

    221124-eknymsfg94

  • MD5

    417f863a2d3820d6c4ea6ea5081a7873

  • SHA1

    ac2ef5877f1d15ad2d82e71b88d1c1028f1ab5d4

  • SHA256

    5b17ac7ea8e13f9e36270b2cea2ceb61636ce64bffdd40240eb081a90c97cde7

  • SHA512

    682f32e00b450a1a737cdb0968ee85b9d175146849a498480fa958b0b41fd05c7b2f63433af5e8dd4fe1f103bf97c22b73b08d961bdf12ad2f499e38b8592521

  • SSDEEP

    3072:ZIDNcIFN3tw4QfwmAOMe6UJbVM/vkA9OQzY6eCFs5Juh2v19hlDcfbEdp7uxEo+i:qJigOTJXYOaFs5Juh819hqkuGh2LeyI

Score
8/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      5b17ac7ea8e13f9e36270b2cea2ceb61636ce64bffdd40240eb081a90c97cde7

    • Size

      304KB

    • MD5

      417f863a2d3820d6c4ea6ea5081a7873

    • SHA1

      ac2ef5877f1d15ad2d82e71b88d1c1028f1ab5d4

    • SHA256

      5b17ac7ea8e13f9e36270b2cea2ceb61636ce64bffdd40240eb081a90c97cde7

    • SHA512

      682f32e00b450a1a737cdb0968ee85b9d175146849a498480fa958b0b41fd05c7b2f63433af5e8dd4fe1f103bf97c22b73b08d961bdf12ad2f499e38b8592521

    • SSDEEP

      3072:ZIDNcIFN3tw4QfwmAOMe6UJbVM/vkA9OQzY6eCFs5Juh2v19hlDcfbEdp7uxEo+i:qJigOTJXYOaFs5Juh819hqkuGh2LeyI

    Score
    8/10
    evasionpersistencetrojanupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks