Overview

overview

10

Static

static

3

b854d5a771...f9.exe

windows7-x64

10

b854d5a771...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b854d5a771cddc8ac0a7c15d7cdc179850e004b3477c3f89b9ed86dab7261ff9

  • Size

    1.1MB

  • Sample

    230612-km3sgabf9x

  • MD5

    98c22b16f480e21990fd03869ff91522

  • SHA1

    a8d581f0f7008e3ee23040fc15dad8cc01447ac9

  • SHA256

    b854d5a771cddc8ac0a7c15d7cdc179850e004b3477c3f89b9ed86dab7261ff9

  • SHA512

    cd71bb07728790469d0514a6fc8e83324460e5efbe64c476b232ade3089c079c6e51f4bbcdf973fa163ba86367cdce6f6bccb6cf67b2e4fad762171071a2aca6

  • SSDEEP

    24576:wC+Gs9TrYCE7ODDe8mYMQKrQKTaO3VMZn7UWtJNOq4rxok+I:S79nlUOne8jMcK+0S7Ucbt4rx

Score
10/10
aspackv2evasiontrojan

Malware Config

Targets

    • Target

      b854d5a771cddc8ac0a7c15d7cdc179850e004b3477c3f89b9ed86dab7261ff9

    • Size

      1.1MB

    • MD5

      98c22b16f480e21990fd03869ff91522

    • SHA1

      a8d581f0f7008e3ee23040fc15dad8cc01447ac9

    • SHA256

      b854d5a771cddc8ac0a7c15d7cdc179850e004b3477c3f89b9ed86dab7261ff9

    • SHA512

      cd71bb07728790469d0514a6fc8e83324460e5efbe64c476b232ade3089c079c6e51f4bbcdf973fa163ba86367cdce6f6bccb6cf67b2e4fad762171071a2aca6

    • SSDEEP

      24576:wC+Gs9TrYCE7ODDe8mYMQKrQKTaO3VMZn7UWtJNOq4rxok+I:S79nlUOne8jMcK+0S7Ucbt4rx

    Score
    10/10
    aspackv2evasiontrojan

    • UAC bypass

      evasiontrojan

    • Downloads MZ/PE file

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks