Overview

overview

8

Static

static

e0ff0fd68b...3a.exe

windows7-x64

8

e0ff0fd68b...3a.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    e0ff0fd68b32e17c2920c214b011f74b00429e0ca207d7e7af45e6c407723f3a

  • Size

    175KB

  • Sample

    221201-t719tage66

  • MD5

    11fdec44f0314de3d9a7c4ac8db1a12f

  • SHA1

    f4553c1ea3cc5db07a5667db807c8a4c054fde3b

  • SHA256

    e0ff0fd68b32e17c2920c214b011f74b00429e0ca207d7e7af45e6c407723f3a

  • SHA512

    deeb8a9c9d50b164ac1d434227e7c65239709c53ab3c911616ee76c1ec612efd01f013b1d58094b0b830f0c71577a9f3ec9f2e30051edcac6e5f59de21f178b7

  • SSDEEP

    3072:fpccrWbhG6u4xdpYf5PP9aWSerL1CYeYx9JCUCfms3KmoH3qdheW/:fpprWbY6ldChPYcwYxeUCfLaH3e

Score
8/10
persistence

Malware Config

Targets

    • Target

      e0ff0fd68b32e17c2920c214b011f74b00429e0ca207d7e7af45e6c407723f3a

    • Size

      175KB

    • MD5

      11fdec44f0314de3d9a7c4ac8db1a12f

    • SHA1

      f4553c1ea3cc5db07a5667db807c8a4c054fde3b

    • SHA256

      e0ff0fd68b32e17c2920c214b011f74b00429e0ca207d7e7af45e6c407723f3a

    • SHA512

      deeb8a9c9d50b164ac1d434227e7c65239709c53ab3c911616ee76c1ec612efd01f013b1d58094b0b830f0c71577a9f3ec9f2e30051edcac6e5f59de21f178b7

    • SSDEEP

      3072:fpccrWbhG6u4xdpYf5PP9aWSerL1CYeYx9JCUCfms3KmoH3qdheW/:fpprWbY6ldChPYcwYxeUCfLaH3e

    Score
    8/10
    persistence

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks