c809dbdc14c1688ded4dcba60ad74adcbfbe63b2fde324032b88ca5479f63fb7 | Triage

Submit
Reports

Overview

overview

8

Static

static

c809dbdc14...b7.exe

windows7-x64

8

c809dbdc14...b7.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

Target

c809dbdc14c1688ded4dcba60ad74adcbfbe63b2fde324032b88ca5479f63fb7
Size

315KB
Sample

221205-gwxq2acd32
MD5

22ab58735a097381d25b06285d8e00a0
SHA1

29e009ee1a78152e6afd00c5471565ee67c67d33
SHA256

c809dbdc14c1688ded4dcba60ad74adcbfbe63b2fde324032b88ca5479f63fb7
SHA512

4fbb3116cee5de5cc19368fc073ff654974b0a3d1e1b1b122c82f0b4fc6aa7e2394a0fc765990e0c4d08ea11bb2824cb27d301b80024d5e84fe5964b126b9ef6
SSDEEP

6144:7N/f4efgsOSBJwfuwtkfAuNCo3pDtWfWtXUCGXaTjPCDhUOJ:d4sgn2fAu5AEEC+QjOUOJ

Score

8^/10

discovery evasion persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

c809dbdc14c1688ded4dcba60ad74adcbfbe63b2fde324032b88ca5479f63fb7.exe

Resource

win7-20221111-en

discovery evasion trojan upx

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

c809dbdc14c1688ded4dcba60ad74adcbfbe63b2fde324032b88ca5479f63fb7.exe

Resource

win10v2004-20221111-en

discovery evasion persistence trojan upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  c809dbdc14c1688ded4dcba60ad74adcbfbe63b2fde324032b88ca5479f63fb7
- Size
  
  315KB
- MD5
  
  22ab58735a097381d25b06285d8e00a0
- SHA1
  
  29e009ee1a78152e6afd00c5471565ee67c67d33
- SHA256
  
  c809dbdc14c1688ded4dcba60ad74adcbfbe63b2fde324032b88ca5479f63fb7
- SHA512
  
  4fbb3116cee5de5cc19368fc073ff654974b0a3d1e1b1b122c82f0b4fc6aa7e2394a0fc765990e0c4d08ea11bb2824cb27d301b80024d5e84fe5964b126b9ef6
- SSDEEP
  
  6144:7N/f4efgsOSBJwfuwtkfAuNCo3pDtWfWtXUCGXaTjPCDhUOJ:d4sgn2fAu5AEEC+QjOUOJ
Score

8^/10

discovery evasion trojan upx persistence
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasiontrojanupx

behavioral2

discoveryevasionpersistencetrojanupx

© 2018-2025

Terms | Privacy