Overview

overview

10

Static

static

6eb5f18896...15.exe

windows7-x64

10

6eb5f18896...15.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615

  • Size

    178KB

  • Sample

    221129-jx4bbaah45

  • MD5

    727cf305772860abd334c71d7bc36059

  • SHA1

    ed9da02796cec03459453485dd44858dda180938

  • SHA256

    6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615

  • SHA512

    26ab7384dbff320132d4d9501456d3ef88e5045cfdf48ef097849f61fab4ea8655e8c07c3d3926500c07e0ddd33291005c7c926db4596e96c600de58a6c6c56a

  • SSDEEP

    3072:5lZeYd+OK4GoCsMQFG+jpAjhMLtnpSjX/1UTyHXgBmJQHOmBODE6TGquD5csHUHK:5rld+O6slgGpmhMhUjaXBQQdB2Cb3LF3

Score
10/10
evasion

Malware Config

Targets

    • Target

      6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615

    • Size

      178KB

    • MD5

      727cf305772860abd334c71d7bc36059

    • SHA1

      ed9da02796cec03459453485dd44858dda180938

    • SHA256

      6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615

    • SHA512

      26ab7384dbff320132d4d9501456d3ef88e5045cfdf48ef097849f61fab4ea8655e8c07c3d3926500c07e0ddd33291005c7c926db4596e96c600de58a6c6c56a

    • SSDEEP

      3072:5lZeYd+OK4GoCsMQFG+jpAjhMLtnpSjX/1UTyHXgBmJQHOmBODE6TGquD5csHUHK:5rld+O6slgGpmhMhUjaXBQQdB2Cb3LF3

    Score
    10/10
    evasion

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks