Overview

overview

8

Static

static

c6d159e177...9b.exe

windows7-x64

8

c6d159e177...9b.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    c6d159e17722f81ba5a2bff2f98f24065704162131f2f9f96e4869503c69ce9b

  • Size

    334KB

  • Sample

    221203-fz5elsgf96

  • MD5

    fb4fe117268997a062609e473768faeb

  • SHA1

    af04f8e5cd55cfcb538d97f6e15fb283bd31d7aa

  • SHA256

    c6d159e17722f81ba5a2bff2f98f24065704162131f2f9f96e4869503c69ce9b

  • SHA512

    d892de988a7346e5211ce6a9e405d2bc5468eeec90f83d90425987a7bb3b323db86254116ea6a14f98a3ee80b21a11bc811300be49fac3dc15b4cf34a7a26e57

  • SSDEEP

    6144:YYp7qvXPU/yglU6Atjq4rdUoBETl/elAPR/X/wPhKM28Rr85JY01nRM1A:7dqv/U/JXQjq4rBEQ+VX/wwM28RwNx6

Score
8/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      c6d159e17722f81ba5a2bff2f98f24065704162131f2f9f96e4869503c69ce9b

    • Size

      334KB

    • MD5

      fb4fe117268997a062609e473768faeb

    • SHA1

      af04f8e5cd55cfcb538d97f6e15fb283bd31d7aa

    • SHA256

      c6d159e17722f81ba5a2bff2f98f24065704162131f2f9f96e4869503c69ce9b

    • SHA512

      d892de988a7346e5211ce6a9e405d2bc5468eeec90f83d90425987a7bb3b323db86254116ea6a14f98a3ee80b21a11bc811300be49fac3dc15b4cf34a7a26e57

    • SSDEEP

      6144:YYp7qvXPU/yglU6Atjq4rdUoBETl/elAPR/X/wPhKM28Rr85JY01nRM1A:7dqv/U/JXQjq4rBEQ+VX/wwM28RwNx6

    Score
    8/10
    evasionpersistenceupx

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks