Overview

overview

7

Static

static

telekom_de...38.exe

windows7-x64

7

telekom_de...38.exe

windows10-2004-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target

    8f65599a4b2b204e81f01c632dbdea2966d653708c076e8cd973f5d072ddf878

  • Size

    124KB

  • Sample

    221124-emlajaga38

  • MD5

    9e8bbf90e270866eef369c0410d7d158

  • SHA1

    2a0c82934054f1c02e0bdf465367488ea499f0fe

  • SHA256

    8f65599a4b2b204e81f01c632dbdea2966d653708c076e8cd973f5d072ddf878

  • SHA512

    2b78a7d453e9e124454f885becdc18d4ee594274745025b9c0104bc1366ad4827ca245a5b69903dbeb919b73a3222d8446a4f24a6bed1ed07128b1d8eab05890

  • SSDEEP

    3072:bbYbQznpGLnCo0dXXxTsuGb+j3FHegipM4:bbAQBdHxwuGWsgE

Score
7/10
persistence

Malware Config

Targets

    • Target

      telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe

    • Size

      156KB

    • MD5

      6fed865f5e569f40c884f0dc9ba21f6f

    • SHA1

      603bf67bad75e611f80d311232edcb9f65706068

    • SHA256

      3f33ae4ea87e4c2f3b2c60152da482a116e9c453662ac438b50458e56edcd87c

    • SHA512

      b6a61eb80fac8d10435fa2280970c58a800fc86751e14bd3d5f1a1c62c7bc5a6b0b5b741770e0c6cfac78de20174d7c1cef6366c7bd0d07cabfad9d173a6cf31

    • SSDEEP

      3072:X2V3Q7emkdat92PH48GLnCo0dXjxTsuGb+j3FRvtVFVlD2Pq:mV3Q6m6at98LdzxwuGWJ7V1D

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks