Overview

overview

10

Static

static

8

87cb596491...98.exe

windows7-x64

10

87cb596491...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    87cb5964915ca11067b541e2b0d5386a3b0ba91526d77c4a7811fa7ef7f2bd98

  • Size

    797KB

  • Sample

    221202-zna66sgd9y

  • MD5

    b0a59b3e78bbd88bef2bba4f21c52a11

  • SHA1

    3df40074876eaf73c3d820866a0a477208e95bba

  • SHA256

    87cb5964915ca11067b541e2b0d5386a3b0ba91526d77c4a7811fa7ef7f2bd98

  • SHA512

    e86fc73a16c8d204a9a0b61b1da6b84e845ad12236df3c0db88a936829e73c17f40e0f8da246c28371776455b2caff3303c52e246f6b2c0cbed32a78f3ea2766

  • SSDEEP

    24576:CofUmZMUH/AlW1R6XjVbHJF3BuG0ojlS7fg:CyiUHolW1IXBj33BuGRjlD

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      87cb5964915ca11067b541e2b0d5386a3b0ba91526d77c4a7811fa7ef7f2bd98

    • Size

      797KB

    • MD5

      b0a59b3e78bbd88bef2bba4f21c52a11

    • SHA1

      3df40074876eaf73c3d820866a0a477208e95bba

    • SHA256

      87cb5964915ca11067b541e2b0d5386a3b0ba91526d77c4a7811fa7ef7f2bd98

    • SHA512

      e86fc73a16c8d204a9a0b61b1da6b84e845ad12236df3c0db88a936829e73c17f40e0f8da246c28371776455b2caff3303c52e246f6b2c0cbed32a78f3ea2766

    • SSDEEP

      24576:CofUmZMUH/AlW1R6XjVbHJF3BuG0ojlS7fg:CyiUHolW1IXBj33BuGRjlD

    Score
    10/10
    evasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks