Overview

overview

10

Static

static

8

aeb8fdb9d2...fd.exe

windows7-x64

10

aeb8fdb9d2...fd.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    aeb8fdb9d250afb4d28afb2776240e0d8dc29de977d43260f63d2266750a84fd

  • Size

    32KB

  • Sample

    221205-ky5q7sdf42

  • MD5

    296802c25b27c01422c216d2eb156fa0

  • SHA1

    b23ff02469ea457ce3cbde4cf413c6148ed9fde7

  • SHA256

    aeb8fdb9d250afb4d28afb2776240e0d8dc29de977d43260f63d2266750a84fd

  • SHA512

    8b3f1bcea387564e6abff33132135641170340070e3241d77e8091c3a01611713c102c78cabe0f6e1b8539e8b83710d6c36558da7da71450b5ac4b408f07657d

  • SSDEEP

    768:Z9uQbTBcj2l9Oe1m2W78A/trjlMEiljI7J+urni:Z9m2ltm7F/jMEilIg+i

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      aeb8fdb9d250afb4d28afb2776240e0d8dc29de977d43260f63d2266750a84fd

    • Size

      32KB

    • MD5

      296802c25b27c01422c216d2eb156fa0

    • SHA1

      b23ff02469ea457ce3cbde4cf413c6148ed9fde7

    • SHA256

      aeb8fdb9d250afb4d28afb2776240e0d8dc29de977d43260f63d2266750a84fd

    • SHA512

      8b3f1bcea387564e6abff33132135641170340070e3241d77e8091c3a01611713c102c78cabe0f6e1b8539e8b83710d6c36558da7da71450b5ac4b408f07657d

    • SSDEEP

      768:Z9uQbTBcj2l9Oe1m2W78A/trjlMEiljI7J+urni:Z9m2ltm7F/jMEilIg+i

    Score
    10/10
    evasionpersistenceupx

    • Modifies firewall policy service

      evasion

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks