Overview

overview

10

Static

static

8

e3c922cfda...40.exe

windows7-x64

8

e3c922cfda...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3c922cfda55941ca84d947c1501304929986694c3eb53daa2304c489ef8cf40

  • Size

    181KB

  • Sample

    221206-r5x39sbc3s

  • MD5

    56a7ecbff7085bc979da3ca04538ffdd

  • SHA1

    7e1b034256dc914f3a0b65540eb562b311703385

  • SHA256

    e3c922cfda55941ca84d947c1501304929986694c3eb53daa2304c489ef8cf40

  • SHA512

    06413d4afb80f37111017fd34f0e4d08c8205b08d7fbee21c8d573e597101354c3f578bd9c718377674e617484ad74f7b481262db9c841892c50a834df6f10d0

  • SSDEEP

    768:+ALz6gvKsQV/+RHjyO3eTRpDToA85UF1ht5Po4IEzNVAw2BS2Pj7OTtGsjUcLbh1:tPZG/4yO3+RpDcxSPrAX22BSCHAtFG

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      e3c922cfda55941ca84d947c1501304929986694c3eb53daa2304c489ef8cf40

    • Size

      181KB

    • MD5

      56a7ecbff7085bc979da3ca04538ffdd

    • SHA1

      7e1b034256dc914f3a0b65540eb562b311703385

    • SHA256

      e3c922cfda55941ca84d947c1501304929986694c3eb53daa2304c489ef8cf40

    • SHA512

      06413d4afb80f37111017fd34f0e4d08c8205b08d7fbee21c8d573e597101354c3f578bd9c718377674e617484ad74f7b481262db9c841892c50a834df6f10d0

    • SSDEEP

      768:+ALz6gvKsQV/+RHjyO3eTRpDToA85UF1ht5Po4IEzNVAw2BS2Pj7OTtGsjUcLbh1:tPZG/4yO3+RpDcxSPrAX22BSCHAtFG

    Score
    10/10
    upxevasionpersistence

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks