Overview

overview

7

Static

static

rechnung_1...05.exe

windows7-x64

7

rechnung_1...05.exe

windows10-2004-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target

    1afe9a9b5cc6ab4013d517a2d618353d5e16abf2ecf69b21c592030b7ad4b282

  • Size

    126KB

  • Sample

    221124-fa5zvada2z

  • MD5

    0cb55d16d33476501f2fe793271ce658

  • SHA1

    fd85ce2411d92fc7229471a0d207e94d2a813060

  • SHA256

    1afe9a9b5cc6ab4013d517a2d618353d5e16abf2ecf69b21c592030b7ad4b282

  • SHA512

    558e4bf289b4153c235bfb47b6c3a24e3c3a6f2b6087b2501387f2c8b756f0513a218a5ac23fb455652637ef1e0376abffddecad1327d033ad030544e7f35201

  • SSDEEP

    3072:qQLmZuIPLyr7blrQStd3jUQdW6CTHeOO16ogZrssU4nYaI0yn:H+Ly/prQqz1QTE6dZrqaYfp

Score
7/10
persistence

Malware Config

Targets

    • Target

      rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

    • Size

      176KB

    • MD5

      72fa9e74d45dda3085eafb77eb497b1a

    • SHA1

      536b13842b5c0ff70177c0c4fd80ce1ff892a15e

    • SHA256

      7a4e899fc05973c8d3fb596750fc1b848daad7cd2cc6cee2c8fb44977e39c45d

    • SHA512

      f5313d65269010038072e25e2ca6859a914a5db31815ee662def861a7809f6098fd25dc68c142efd5e0929e420221393e73aa77fbcd4ba8af4da95a73329737c

    • SSDEEP

      3072:zQnHNmI+yMkJR+Omz1C+cSQStd3jUQdW6OTHeOO16ogZrssN6wc+ga0Mhze:zwHBRtJ2BC+Cqz14TE6dZr5PQ

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks