Overview

overview

8

Static

static

8

f941c58c0b...c0.exe

windows7-x64

8

f941c58c0b...c0.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f941c58c0bf08428acf3fa391951cef2a16f20d38c7b7cc4c1b16a7b253dc8c0

  • Size

    25KB

  • Sample

    221205-v36t6sag87

  • MD5

    94611f28cdf5f806fa74bff3a36f2d04

  • SHA1

    078249af00007da6cb53900285fd08d11a3ff0ad

  • SHA256

    f941c58c0bf08428acf3fa391951cef2a16f20d38c7b7cc4c1b16a7b253dc8c0

  • SHA512

    369e00b5431089eb0a08034e375c2ce393a232005b9753ce13a70a961a085a6322792ba36967d4b6120179c9886a08ae5ddbc4062e57209eb74a11fb09551c76

  • SSDEEP

    768:VCSHV6K3hklXHFjd5cqFKyo6/Fl919G4:5EKCD5cCLJP91o4

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      f941c58c0bf08428acf3fa391951cef2a16f20d38c7b7cc4c1b16a7b253dc8c0

    • Size

      25KB

    • MD5

      94611f28cdf5f806fa74bff3a36f2d04

    • SHA1

      078249af00007da6cb53900285fd08d11a3ff0ad

    • SHA256

      f941c58c0bf08428acf3fa391951cef2a16f20d38c7b7cc4c1b16a7b253dc8c0

    • SHA512

      369e00b5431089eb0a08034e375c2ce393a232005b9753ce13a70a961a085a6322792ba36967d4b6120179c9886a08ae5ddbc4062e57209eb74a11fb09551c76

    • SSDEEP

      768:VCSHV6K3hklXHFjd5cqFKyo6/Fl919G4:5EKCD5cCLJP91o4

    Score
    8/10
    persistenceupx

    • Blocklisted process makes network request

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks