Overview

overview

9

Static

static

8

ac59b4fab6...65.exe

windows7-x64

9

ac59b4fab6...65.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65

  • Size

    479KB

  • Sample

    221129-g64mbsge3y

  • MD5

    3eb9b8b5e2865bc2850a859bbd70c811

  • SHA1

    50b4294b9ab808e571fa0db4393ee31541a2c251

  • SHA256

    ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65

  • SHA512

    78b3f03753ce1a1ef51bf2fc3314087a5016c6a56ce787e0d497c11858d348e3acf395497ecb95b65a480a524a48ef25e2abb56305681fd2acd42c55490ea603

  • SSDEEP

    6144:9FIDFEULXJ9VBdcs9ZLbw64TgEg8fcwZRcF5vVATpJNbyUiAadSilHDTc:9FIJHxJ9ZLbw/TPcw0rVMLoAad/DTc

Score
9/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65

    • Size

      479KB

    • MD5

      3eb9b8b5e2865bc2850a859bbd70c811

    • SHA1

      50b4294b9ab808e571fa0db4393ee31541a2c251

    • SHA256

      ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65

    • SHA512

      78b3f03753ce1a1ef51bf2fc3314087a5016c6a56ce787e0d497c11858d348e3acf395497ecb95b65a480a524a48ef25e2abb56305681fd2acd42c55490ea603

    • SSDEEP

      6144:9FIDFEULXJ9VBdcs9ZLbw64TgEg8fcwZRcF5vVATpJNbyUiAadSilHDTc:9FIJHxJ9ZLbw/TPcw0rVMLoAad/DTc

    Score
    9/10
    evasionpersistencetrojanupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks for any installed AV software in registry

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks