Overview

overview

8

Static

static

CF߱Ѫ�...se.exe

windows7-x64

8

CF߱Ѫ�...se.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ffa06a0b6472ee8fc0ea10e2738b8a19dcc3a324a8160834354c77daf8d4adbe

  • Size

    1.7MB

  • Sample

    221124-tttb2seh82

  • MD5

    dbc7b3e469f995d3387daacec6fcb9ff

  • SHA1

    22a0efe20545e5d6b945b08c594bf259ed9dfc97

  • SHA256

    ffa06a0b6472ee8fc0ea10e2738b8a19dcc3a324a8160834354c77daf8d4adbe

  • SHA512

    2e683a870b6ec6f71629052cfd0623eb0065b8c5fbca1166d6e59840714007b17667d21b3fa701c614e601515b3b0908b77b8406adca76367fba9a67d0836a0c

  • SSDEEP

    49152:lxL381rLOUhhr0zHo7unZzguo24m/t/5mSMpo0xFMus:lt81raUhhv7uZz7tV/j6xs

Score
8/10
persistence

Malware Config

Targets

    • Target

      CF߱ѪϷﴴհ_se.exe

    • Size

      1.8MB

    • MD5

      e16b6dd2a493279f1a39207e50fcb27a

    • SHA1

      61f347c792be9660b3ff37f44c2258c56056aac8

    • SHA256

      4c1f0a44b9ef6d7a74959b34b83c23a01a33f5968964bac1d539eb0b69df9091

    • SHA512

      5c1c85104ded3873fed5aa2e1814559c98613fec408ef1dc2ef8d3fb58ab377cba52293440bc6453cce936cbefac2ca45c61fcd9bea43e44f9979f567d3c094e

    • SSDEEP

      49152:O281tpeqhhD0xFEhqnZ1gXHQ3ePWvs5jIxhk4Aey70rAUmxFWv:O281twqhh5hqZ1akcWCjIxhkrykC

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks