Overview

overview

8

Static

static

8

aaacb5eb72...11.exe

windows7-x64

8

aaacb5eb72...11.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    aaacb5eb7282a1f83b19111e13fd30e793c8648ee62846610c9607b0eee9c211

  • Size

    192KB

  • Sample

    221129-d3xstseh9s

  • MD5

    facd7f4533635c54eccab2aba3897158

  • SHA1

    5dd45f3eb3beac1b331f9e7201d9457be793c525

  • SHA256

    aaacb5eb7282a1f83b19111e13fd30e793c8648ee62846610c9607b0eee9c211

  • SHA512

    1de8c33f493a8a9b22dfb79ee925628cae83752d519ae939559dd0e7aae674d6c6ac1c8d7b690aee4dcca9133e7c12052921c4bd17c19bf2a1ba592deceae7b3

  • SSDEEP

    3072:bljJV17KnXALAhO3P7NZEyUJltdzDGXaC8BmWme3WhBANBFYE/CzxxjCKDKDwLpe:dBKntf2aZBmWLbluO1MLx3EDoSt

Score
8/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      aaacb5eb7282a1f83b19111e13fd30e793c8648ee62846610c9607b0eee9c211

    • Size

      192KB

    • MD5

      facd7f4533635c54eccab2aba3897158

    • SHA1

      5dd45f3eb3beac1b331f9e7201d9457be793c525

    • SHA256

      aaacb5eb7282a1f83b19111e13fd30e793c8648ee62846610c9607b0eee9c211

    • SHA512

      1de8c33f493a8a9b22dfb79ee925628cae83752d519ae939559dd0e7aae674d6c6ac1c8d7b690aee4dcca9133e7c12052921c4bd17c19bf2a1ba592deceae7b3

    • SSDEEP

      3072:bljJV17KnXALAhO3P7NZEyUJltdzDGXaC8BmWme3WhBANBFYE/CzxxjCKDKDwLpe:dBKntf2aZBmWLbluO1MLx3EDoSt

    Score
    8/10
    evasionpersistenceupx

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks