Overview

overview

9

Static

static

8

f50d5d9364...79.exe

windows7-x64

9

f50d5d9364...79.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    f50d5d936450f74f67035343ef3ce1cd15f0ac39221acb584cd04400451ab979

  • Size

    1.5MB

  • Sample

    221129-mqbt9sbc37

  • MD5

    f6f9bc6f1fbd08288aeb93d28296bdbe

  • SHA1

    baad2ad78d57f56ecc070d9d2836923f42b4e97b

  • SHA256

    f50d5d936450f74f67035343ef3ce1cd15f0ac39221acb584cd04400451ab979

  • SHA512

    598e824a2e5a7b565d47ef39b51bb118e2159e4c8bb678c1f0b06a0ad34d9df6afb403bb4ab784f567f619795ead0f312d32430ec1bac42cae80939784bc9166

  • SSDEEP

    49152:7D6i+lgxKHIlZLSvlOXwsB0xg8zUrXaam:J+lggSLSvlOr0xg8zCXq

Score
9/10
persistenceupx

Malware Config

Targets

    • Target

      f50d5d936450f74f67035343ef3ce1cd15f0ac39221acb584cd04400451ab979

    • Size

      1.5MB

    • MD5

      f6f9bc6f1fbd08288aeb93d28296bdbe

    • SHA1

      baad2ad78d57f56ecc070d9d2836923f42b4e97b

    • SHA256

      f50d5d936450f74f67035343ef3ce1cd15f0ac39221acb584cd04400451ab979

    • SHA512

      598e824a2e5a7b565d47ef39b51bb118e2159e4c8bb678c1f0b06a0ad34d9df6afb403bb4ab784f567f619795ead0f312d32430ec1bac42cae80939784bc9166

    • SSDEEP

      49152:7D6i+lgxKHIlZLSvlOXwsB0xg8zUrXaam:J+lggSLSvlOr0xg8zCXq

    Score
    9/10
    persistenceupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks