Overview

overview

8

Static

static

8

d1e34cb8d4...11.exe

windows7-x64

8

d1e34cb8d4...11.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    d1e34cb8d41b63aeb2c51e65a1e27c6097fd43a4299dc0d8824d223966bb8d11

  • Size

    262KB

  • Sample

    221206-w798tscg49

  • MD5

    0caa0ce957aea077e698528b46beefac

  • SHA1

    d199dda1c9c916b3f8f1ec38796a42d6b96484d9

  • SHA256

    d1e34cb8d41b63aeb2c51e65a1e27c6097fd43a4299dc0d8824d223966bb8d11

  • SHA512

    deb658da88a564efdcdd697319a8e8579246c549e88090e052ebd0180d37ba5f02512129e16e062067054205ea9c690cb979f205501b03c794ca74a7da589b10

  • SSDEEP

    6144:/f0xShubCA5WW3WvagHY1cttnUegoJqOBvXupdCygWhoS7:/f0xdbjzWvD2utnUegYqqvepf/hoS7

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      d1e34cb8d41b63aeb2c51e65a1e27c6097fd43a4299dc0d8824d223966bb8d11

    • Size

      262KB

    • MD5

      0caa0ce957aea077e698528b46beefac

    • SHA1

      d199dda1c9c916b3f8f1ec38796a42d6b96484d9

    • SHA256

      d1e34cb8d41b63aeb2c51e65a1e27c6097fd43a4299dc0d8824d223966bb8d11

    • SHA512

      deb658da88a564efdcdd697319a8e8579246c549e88090e052ebd0180d37ba5f02512129e16e062067054205ea9c690cb979f205501b03c794ca74a7da589b10

    • SSDEEP

      6144:/f0xShubCA5WW3WvagHY1cttnUegoJqOBvXupdCygWhoS7:/f0xdbjzWvD2utnUegYqqvepf/hoS7

    Score
    8/10
    persistenceupx

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks