Overview

overview

8

Static

static

ED3E434362...33.exe

windows7-x64

8

ED3E434362...33.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    ED3E434362045111E48B9D30C9CB1DD21F58DC625B4CD862CF483ECC5A61DF33.zip

  • Size

    8.4MB

  • Sample

    221222-kwg75aeb75

  • MD5

    5d4495b65a2e36ef55f7f8d1d6c50883

  • SHA1

    aaaaf03c36dae88c950f0be8145e5614a6ec0cb3

  • SHA256

    031eb3e4a890c16279015f163118ed280ceec5ef524aaf3e4e4891de8242b32c

  • SHA512

    d55ecd8adea8e29feb3a5005ab5aa94c4e9b6844e11f3f8683e48cb83bf9ace742439425f21138234c38969786850e541b1ddea6c8ae3d63762204e8722ed670

  • SSDEEP

    196608:kGnAuOGTbfAOqY8Qfdkz1LjKFAh9YIPsmoJJ4ujOt5XHpX:kl3GwzQfwLjKFw9/PDobPSt5ZX

Score
8/10
discoveryevasionupx

Malware Config

Targets

    • Target

      ED3E434362045111E48B9D30C9CB1DD21F58DC625B4CD862CF483ECC5A61DF33

    • Size

      8.6MB

    • MD5

      a590a3b8eb80efd0b8ce98bfe1f6f465

    • SHA1

      a1db5703428e8bc6ecf3f0e425db647375561f22

    • SHA256

      ed3e434362045111e48b9d30c9cb1dd21f58dc625b4cd862cf483ecc5a61df33

    • SHA512

      777af0c9f32497165053b886fc1773a9db5cc281971ed1fc9f666bbed839ef510339e13753b6c5626c7504df1381096a3c42c6ae49d6b99f0e9b8fcb51540c7b

    • SSDEEP

      196608:TRAwoqFBMTns8HJAiQqGkr3DRnDSuTJ6ZMW9j:TRAfA0ZJr53ZSuk

    Score
    8/10
    discoveryevasionupx

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks