Overview

overview

8

Static

static

8

e935fd3b6c...74.exe

windows7-x64

8

e935fd3b6c...74.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    e935fd3b6c0a6e08cff12ca632bfbb60ace287563a85d6e9f19a38c538780174

  • Size

    544KB

  • Sample

    221203-vjlpwsdb31

  • MD5

    b8129cf0a7a83b9cfc83b39d44c88297

  • SHA1

    8c45de5aae84f047735f26a61713c57172697d02

  • SHA256

    e935fd3b6c0a6e08cff12ca632bfbb60ace287563a85d6e9f19a38c538780174

  • SHA512

    d5b9e4f1e33b8db03c03b568d9a2a975665a4ab1dc3c3fd32af27191049e920e8ac5b85fd419c2dce0d2590f340ad39de34eb696e58b1f4cec7b79ccad7187f7

  • SSDEEP

    12288:XagbFaiby8LbNdWBrtVpJSx5DtSMaMipROaM3WeIA7:Yiby83KBrxGUMW4G1W

Score
8/10
aspackv2evasionpersistencetrojan

Malware Config

Targets

    • Target

      e935fd3b6c0a6e08cff12ca632bfbb60ace287563a85d6e9f19a38c538780174

    • Size

      544KB

    • MD5

      b8129cf0a7a83b9cfc83b39d44c88297

    • SHA1

      8c45de5aae84f047735f26a61713c57172697d02

    • SHA256

      e935fd3b6c0a6e08cff12ca632bfbb60ace287563a85d6e9f19a38c538780174

    • SHA512

      d5b9e4f1e33b8db03c03b568d9a2a975665a4ab1dc3c3fd32af27191049e920e8ac5b85fd419c2dce0d2590f340ad39de34eb696e58b1f4cec7b79ccad7187f7

    • SSDEEP

      12288:XagbFaiby8LbNdWBrtVpJSx5DtSMaMipROaM3WeIA7:Yiby83KBrxGUMW4G1W

    Score
    8/10
    aspackv2evasiontrojanpersistence

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks