Overview

overview

8

Static

static

7

Unhide.exe

windows7-x64

8

Unhide.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Unhide.exe

  • Size

    668KB

  • Sample

    230614-w8vjrsce43

  • MD5

    0c3717b91073d5e4a8097b69331646a5

  • SHA1

    1c3e14bf1b3b20736ca84f4d3a000dd8cbb84a59

  • SHA256

    28486a0eb0a65e2c926a44dc8559ccd6deec153b784d91698382512c82cdb401

  • SHA512

    a52ee1760327063b5bba79d6da74788d1971dce1466e94e0c4bf2a4283dcf662314635099a4ff885e50683a9817022ef4aec2d8bda23dc132f4ac4773252e564

  • SSDEEP

    12288:fxTCGTc6rYLF4s7E2vqsIG+OBxUkK3nn8eQ3Gj0Hy/23vc8/:pTlQ6rgPE2vagxdynMGjD/8vP

Score
8/10
ransomwareupx

Malware Config

Targets

    • Target

      Unhide.exe

    • Size

      668KB

    • MD5

      0c3717b91073d5e4a8097b69331646a5

    • SHA1

      1c3e14bf1b3b20736ca84f4d3a000dd8cbb84a59

    • SHA256

      28486a0eb0a65e2c926a44dc8559ccd6deec153b784d91698382512c82cdb401

    • SHA512

      a52ee1760327063b5bba79d6da74788d1971dce1466e94e0c4bf2a4283dcf662314635099a4ff885e50683a9817022ef4aec2d8bda23dc132f4ac4773252e564

    • SSDEEP

      12288:fxTCGTc6rYLF4s7E2vqsIG+OBxUkK3nn8eQ3Gj0Hy/23vc8/:pTlQ6rgPE2vagxdynMGjD/8vP

    Score
    8/10
    ransomwareupx

    • Drops file in Drivers directory

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks