Overview

overview

10

Static

static

8

fa5185c688...af.exe

windows7-x64

8

fa5185c688...af.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fa5185c688262b8a20a1028ea1826e461a44eacf76d1d02b402610792f0266af

  • Size

    566KB

  • Sample

    221128-ey2fwsad4v

  • MD5

    07fe041e7396665bc09d3d9f518aba9b

  • SHA1

    b474dcc393decbbf5f3d64cb02207f645ac68ac3

  • SHA256

    fa5185c688262b8a20a1028ea1826e461a44eacf76d1d02b402610792f0266af

  • SHA512

    a1e8c1751e7112151fa847e56a26c5ef0e5484dbf551c8d279b59e91462a8d5bdcefab9de8ee5d3391c6b4280c424c2a1191fdaa31509363b674fc21157cb8dd

  • SSDEEP

    12288:o6Wq4aaE6KwyF5L0Y2D1PqLjJ/NUmDAFC/kP01MzKoKq+TX2yrI39Rx:+thEVaPqL9/NvDAFxEMuoKq+z2v9n

Score
10/10
persistenceupx

Malware Config

Targets

    • Target

      fa5185c688262b8a20a1028ea1826e461a44eacf76d1d02b402610792f0266af

    • Size

      566KB

    • MD5

      07fe041e7396665bc09d3d9f518aba9b

    • SHA1

      b474dcc393decbbf5f3d64cb02207f645ac68ac3

    • SHA256

      fa5185c688262b8a20a1028ea1826e461a44eacf76d1d02b402610792f0266af

    • SHA512

      a1e8c1751e7112151fa847e56a26c5ef0e5484dbf551c8d279b59e91462a8d5bdcefab9de8ee5d3391c6b4280c424c2a1191fdaa31509363b674fc21157cb8dd

    • SSDEEP

      12288:o6Wq4aaE6KwyF5L0Y2D1PqLjJ/NUmDAFC/kP01MzKoKq+TX2yrI39Rx:+thEVaPqL9/NvDAFxEMuoKq+z2v9n

    Score
    10/10
    upxpersistence

    • Modifies WinLogon for persistence

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks