Overview

overview

7

Static

static

3

2da80c7c23...b7.exe

windows7-x64

7

2da80c7c23...b7.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    2da80c7c23bcc560350ada7ee87788e07f1c8a5c7976a118d82b737748814db7

  • Size

    646KB

  • Sample

    230504-q1fgzscf98

  • MD5

    a166c0a269f3883d10de0d9167a71f13

  • SHA1

    7f2a24eaced6043dd710e93e3328d4c834dbca45

  • SHA256

    2da80c7c23bcc560350ada7ee87788e07f1c8a5c7976a118d82b737748814db7

  • SHA512

    c1658e55295a3b9f8295e211ae0abe8344c5305ff916098e19b2046addffd46196d41ae57e2c184d419b9e3cc422976f0da4a16bd68d2e498aac8a02d17c8060

  • SSDEEP

    12288:PVNvjB1YWvhDYr/rrn/olzhJ8evF3Vp8Vaa7vNQCQQcHvt:PVNv11JMrTWFJ8edn+NzNvQQcPt

Score
7/10
discovery

Malware Config

Targets

    • Target

      2da80c7c23bcc560350ada7ee87788e07f1c8a5c7976a118d82b737748814db7

    • Size

      646KB

    • MD5

      a166c0a269f3883d10de0d9167a71f13

    • SHA1

      7f2a24eaced6043dd710e93e3328d4c834dbca45

    • SHA256

      2da80c7c23bcc560350ada7ee87788e07f1c8a5c7976a118d82b737748814db7

    • SHA512

      c1658e55295a3b9f8295e211ae0abe8344c5305ff916098e19b2046addffd46196d41ae57e2c184d419b9e3cc422976f0da4a16bd68d2e498aac8a02d17c8060

    • SSDEEP

      12288:PVNvjB1YWvhDYr/rrn/olzhJ8evF3Vp8Vaa7vNQCQQcHvt:PVNv11JMrTWFJ8edn+NzNvQQcPt

    Score
    7/10
    discovery

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks