Overview

overview

8

Static

static

8

b10a04d9ea...dd.exe

windows7-x64

8

b10a04d9ea...dd.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    b10a04d9ea2bd6c7316395929ac53b800a7bd027e09be0be3deb6cee6e5d02dd

  • Size

    154KB

  • Sample

    221206-phfjlabe2w

  • MD5

    e4a772b75b468ebbd1c00267ef70b885

  • SHA1

    50fe653b9f98f3a8f1f28adb8082f821bc419d7b

  • SHA256

    b10a04d9ea2bd6c7316395929ac53b800a7bd027e09be0be3deb6cee6e5d02dd

  • SHA512

    9e8132731902988298a2346417cb2e21d0f7404c9bc827079344d16dfbee550141b2fb7486558d282d18ff441d7dfbcd1cf0450abed5f20fab80f32414bbae50

  • SSDEEP

    3072:pBcBuWAXJJ0W+KmdCxPD4t2r4H269kEztSzqN0eRe8qDYs:p6BBAZy7KeQb4gr4HP9zZPjwx

Score
8/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      b10a04d9ea2bd6c7316395929ac53b800a7bd027e09be0be3deb6cee6e5d02dd

    • Size

      154KB

    • MD5

      e4a772b75b468ebbd1c00267ef70b885

    • SHA1

      50fe653b9f98f3a8f1f28adb8082f821bc419d7b

    • SHA256

      b10a04d9ea2bd6c7316395929ac53b800a7bd027e09be0be3deb6cee6e5d02dd

    • SHA512

      9e8132731902988298a2346417cb2e21d0f7404c9bc827079344d16dfbee550141b2fb7486558d282d18ff441d7dfbcd1cf0450abed5f20fab80f32414bbae50

    • SSDEEP

      3072:pBcBuWAXJJ0W+KmdCxPD4t2r4H269kEztSzqN0eRe8qDYs:p6BBAZy7KeQb4gr4HP9zZPjwx

    Score
    8/10
    evasionpersistenceupx

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks