Overview

overview

8

Static

static

47ba81cca4...e5.exe

windows7-x64

8

47ba81cca4...e5.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    47ba81cca488d64063d332a72c170edc4bd02dc2de15ee38e7e481aa969263e5

  • Size

    160KB

  • Sample

    221205-x4a51aha62

  • MD5

    04ee72b4dd0cacc10beb746cc3949930

  • SHA1

    5ffcde37b009fdb6381feb96c4142e0502453748

  • SHA256

    47ba81cca488d64063d332a72c170edc4bd02dc2de15ee38e7e481aa969263e5

  • SHA512

    51c1706d74ed6734af37030c040916f6067ea3cb9ae3e0820e5215bbb8fff7608c2756bd0227070a0ee1acbe36c35526ebe1b58ae1ff2cc964c8a0b5f92e0448

  • SSDEEP

    1536:3+gDbKlmyJKz5jR7766dxocisPfDsCUjhe+SPBp9oEoTTLgY++++1sY+++++ZDdM:3xbkuVbvLn7Uj3

Score
8/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      47ba81cca488d64063d332a72c170edc4bd02dc2de15ee38e7e481aa969263e5

    • Size

      160KB

    • MD5

      04ee72b4dd0cacc10beb746cc3949930

    • SHA1

      5ffcde37b009fdb6381feb96c4142e0502453748

    • SHA256

      47ba81cca488d64063d332a72c170edc4bd02dc2de15ee38e7e481aa969263e5

    • SHA512

      51c1706d74ed6734af37030c040916f6067ea3cb9ae3e0820e5215bbb8fff7608c2756bd0227070a0ee1acbe36c35526ebe1b58ae1ff2cc964c8a0b5f92e0448

    • SSDEEP

      1536:3+gDbKlmyJKz5jR7766dxocisPfDsCUjhe+SPBp9oEoTTLgY++++1sY+++++ZDdM:3xbkuVbvLn7Uj3

    Score
    8/10
    evasionpersistencetrojanupx

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks