Overview

overview

8

Static

static

82e42df3ee...49.exe

windows7-x64

8

82e42df3ee...49.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    82e42df3ee5f38d103e9924c96997e554efb1f2128970594150bd44d31c0e049

  • Size

    100KB

  • Sample

    221201-zbl3xace3w

  • MD5

    0a1ba3f429bc1240e69dbe447d22eeb1

  • SHA1

    f8b6287f8827f5326dcfca0bcf810f4b5a4551d3

  • SHA256

    82e42df3ee5f38d103e9924c96997e554efb1f2128970594150bd44d31c0e049

  • SHA512

    bbb5fdec0f9fb971de32d2be974bfba29f83fe43ea27a8031ae358aa14f9b8a3ee5a916b6e76323ddf07272dd4ed891f93d63371c9057070f4fb84b762db37c6

  • SSDEEP

    1536:DvogCo2VU1nVjdTOebFxWrGpDbuF0eePNsFMxcjUpGoWNcKt6EURT:Toto2yVxTOCzWrGpDOUN4M85vNcKJw

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      82e42df3ee5f38d103e9924c96997e554efb1f2128970594150bd44d31c0e049

    • Size

      100KB

    • MD5

      0a1ba3f429bc1240e69dbe447d22eeb1

    • SHA1

      f8b6287f8827f5326dcfca0bcf810f4b5a4551d3

    • SHA256

      82e42df3ee5f38d103e9924c96997e554efb1f2128970594150bd44d31c0e049

    • SHA512

      bbb5fdec0f9fb971de32d2be974bfba29f83fe43ea27a8031ae358aa14f9b8a3ee5a916b6e76323ddf07272dd4ed891f93d63371c9057070f4fb84b762db37c6

    • SSDEEP

      1536:DvogCo2VU1nVjdTOebFxWrGpDbuF0eePNsFMxcjUpGoWNcKt6EURT:Toto2yVxTOCzWrGpDOUN4M85vNcKJw

    Score
    8/10
    persistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks