Overview

overview

8

Static

static

8

d3df08818e...0d.exe

windows7-x64

8

d3df08818e...0d.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    d3df08818e95a85946430329a420f1fdeb76fe7d1ce774d283bb0b41dec0330d

  • Size

    162KB

  • Sample

    221203-eqraysgd8w

  • MD5

    e239db2e771178fe56df55aa384b98b1

  • SHA1

    58ab7582f9c184bb216ca5c3b9df5c908cdf712a

  • SHA256

    d3df08818e95a85946430329a420f1fdeb76fe7d1ce774d283bb0b41dec0330d

  • SHA512

    5ceb6bdf57fdc5ac7ba193db0fa17c5cad51cbfe811b03fe5ee6f033a034c58095b4a0f4025a36a5bf8755d9c133666f274af8211a6bf3e0a4b297f7767f86e9

  • SSDEEP

    3072:+bH5phZFTumpRfkmULG5XriNvnFGx9scmY2vFn1/qM04ftfFVE57ne:+bZp1LrIGxriNv/cmdF1+4/V4e

Score
8/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      d3df08818e95a85946430329a420f1fdeb76fe7d1ce774d283bb0b41dec0330d

    • Size

      162KB

    • MD5

      e239db2e771178fe56df55aa384b98b1

    • SHA1

      58ab7582f9c184bb216ca5c3b9df5c908cdf712a

    • SHA256

      d3df08818e95a85946430329a420f1fdeb76fe7d1ce774d283bb0b41dec0330d

    • SHA512

      5ceb6bdf57fdc5ac7ba193db0fa17c5cad51cbfe811b03fe5ee6f033a034c58095b4a0f4025a36a5bf8755d9c133666f274af8211a6bf3e0a4b297f7767f86e9

    • SSDEEP

      3072:+bH5phZFTumpRfkmULG5XriNvnFGx9scmY2vFn1/qM04ftfFVE57ne:+bZp1LrIGxriNv/cmdF1+4/V4e

    Score
    8/10
    evasionpersistenceupx

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks