Overview

overview

10

Static

static

ea3b2942e0...b1.exe

windows7-x64

10

ea3b2942e0...b1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ea3b2942e0aa2e3aa50b762e9e39bc769cd83ae418be61fa9a5b31902292ffb1

  • Size

    151KB

  • Sample

    221207-eb878acd55

  • MD5

    4c7164880a56e27b99b3312f1cc7f8e6

  • SHA1

    96bf4e4222e0f909d0f8b35f218e525eb6df8760

  • SHA256

    ea3b2942e0aa2e3aa50b762e9e39bc769cd83ae418be61fa9a5b31902292ffb1

  • SHA512

    0603af4272bf10450ca05f4cf5afeedfc59a87bf8f1128b55ce609e18aeba6a60679220ee42f1abb563df0cc2c1953ed70440814161a9ab3a4d897b421018e7e

  • SSDEEP

    3072:QRLcbq6lxuD6mybV/PkKjzkr24QFKsCiPBdHG:QRD66DQkK0hgKO3G

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      ea3b2942e0aa2e3aa50b762e9e39bc769cd83ae418be61fa9a5b31902292ffb1

    • Size

      151KB

    • MD5

      4c7164880a56e27b99b3312f1cc7f8e6

    • SHA1

      96bf4e4222e0f909d0f8b35f218e525eb6df8760

    • SHA256

      ea3b2942e0aa2e3aa50b762e9e39bc769cd83ae418be61fa9a5b31902292ffb1

    • SHA512

      0603af4272bf10450ca05f4cf5afeedfc59a87bf8f1128b55ce609e18aeba6a60679220ee42f1abb563df0cc2c1953ed70440814161a9ab3a4d897b421018e7e

    • SSDEEP

      3072:QRLcbq6lxuD6mybV/PkKjzkr24QFKsCiPBdHG:QRD66DQkK0hgKO3G

    Score
    10/10
    evasionpersistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks