Overview

overview

8

Static

static

83232b0e9b...29.exe

windows7-x64

8

83232b0e9b...29.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    83232b0e9b061f7d04b40be1a6c569b03bb66fb9db6707409dab4fa3c8824e29

  • Size

    110KB

  • Sample

    221201-ck4b8ahh61

  • MD5

    6159f25739615beb55e7bed8e1132e2e

  • SHA1

    81613fa7b6af7d9fe90acf92487af6bf6bb6d646

  • SHA256

    83232b0e9b061f7d04b40be1a6c569b03bb66fb9db6707409dab4fa3c8824e29

  • SHA512

    458011d810a4c54f5d0b1e39b4b1b743e16076d609d3267c912297f374647b2bdaccceb1260732c28fd7ac825c46a17fea619e2fcb1532b220c3b03ff8717e23

  • SSDEEP

    3072:8HIFzvdkiRvZ38z+WgnYFU0W1a+Aa7jQuR8z9xGyndtw:zvdkiRvlTW0NlR8z/Gaw

Score
8/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      83232b0e9b061f7d04b40be1a6c569b03bb66fb9db6707409dab4fa3c8824e29

    • Size

      110KB

    • MD5

      6159f25739615beb55e7bed8e1132e2e

    • SHA1

      81613fa7b6af7d9fe90acf92487af6bf6bb6d646

    • SHA256

      83232b0e9b061f7d04b40be1a6c569b03bb66fb9db6707409dab4fa3c8824e29

    • SHA512

      458011d810a4c54f5d0b1e39b4b1b743e16076d609d3267c912297f374647b2bdaccceb1260732c28fd7ac825c46a17fea619e2fcb1532b220c3b03ff8717e23

    • SSDEEP

      3072:8HIFzvdkiRvZ38z+WgnYFU0W1a+Aa7jQuR8z9xGyndtw:zvdkiRvlTW0NlR8z/Gaw

    Score
    8/10
    evasionpersistenceupx

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks