Overview

overview

8

Static

static

bf40ca2d53...73.exe

windows7-x64

8

bf40ca2d53...73.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf40ca2d5341a180a7d232192808f156727850885a3ec6169b7153d69871ba73

  • Size

    169KB

  • Sample

    221203-rbwcksba2v

  • MD5

    487ee9edfb0eb895e36de35217fa6f4c

  • SHA1

    7ed6492ce0bc1dfd8c1621d4411ff2d7623ad42d

  • SHA256

    bf40ca2d5341a180a7d232192808f156727850885a3ec6169b7153d69871ba73

  • SHA512

    07b629f622e675730b850f82e36e86864167f4cd4f6b19f2d38bef3634c3429d225e999829899e62d40f0a3cc32b970db224246081bda5f19634ec2519eb1ced

  • SSDEEP

    3072:9ZTTNKts7hlijUVNDljfyTepveLVO1U/X/kKlOFcsLvTFjXQauU+:nNNlQU3JjhveLVO1W/kUOGsLtA9r

Score
8/10
persistence

Malware Config

Targets

    • Target

      bf40ca2d5341a180a7d232192808f156727850885a3ec6169b7153d69871ba73

    • Size

      169KB

    • MD5

      487ee9edfb0eb895e36de35217fa6f4c

    • SHA1

      7ed6492ce0bc1dfd8c1621d4411ff2d7623ad42d

    • SHA256

      bf40ca2d5341a180a7d232192808f156727850885a3ec6169b7153d69871ba73

    • SHA512

      07b629f622e675730b850f82e36e86864167f4cd4f6b19f2d38bef3634c3429d225e999829899e62d40f0a3cc32b970db224246081bda5f19634ec2519eb1ced

    • SSDEEP

      3072:9ZTTNKts7hlijUVNDljfyTepveLVO1U/X/kKlOFcsLvTFjXQauU+:nNNlQU3JjhveLVO1W/kUOGsLtA9r

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Deletes itself

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks