Overview

overview

8

Static

static

7

cd1bb3e15e...18.dll

windows7-x64

8

cd1bb3e15e...18.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd1bb3e15e00395238f8f995f0f206bde69479d422c119517685fd009e951218

  • Size

    2.9MB

  • Sample

    230624-sxnqasbf83

  • MD5

    71c3d24af19ec09608dabf93f56e8c80

  • SHA1

    3da1104b67c1509c27c1236369016594a0641048

  • SHA256

    cd1bb3e15e00395238f8f995f0f206bde69479d422c119517685fd009e951218

  • SHA512

    0043022ac9ba177b19c04105c55cb6c75ca0d1aeb3f029cd1afe1dfee196306d4f55b481523a22ec61ab889508117d37b1f08ae642da270f171f83e8b2296a5e

  • SSDEEP

    49152:/q3jDLMcXShsmWF73/YqYAWysjU3BFFspj2xI8g7k/Y2idB+V:0vFSmlhYAWyssBFFAGInwidC

Score
8/10
aspackv2persistence

Malware Config

Targets

    • Target

      cd1bb3e15e00395238f8f995f0f206bde69479d422c119517685fd009e951218

    • Size

      2.9MB

    • MD5

      71c3d24af19ec09608dabf93f56e8c80

    • SHA1

      3da1104b67c1509c27c1236369016594a0641048

    • SHA256

      cd1bb3e15e00395238f8f995f0f206bde69479d422c119517685fd009e951218

    • SHA512

      0043022ac9ba177b19c04105c55cb6c75ca0d1aeb3f029cd1afe1dfee196306d4f55b481523a22ec61ab889508117d37b1f08ae642da270f171f83e8b2296a5e

    • SSDEEP

      49152:/q3jDLMcXShsmWF73/YqYAWysjU3BFFspj2xI8g7k/Y2idB+V:0vFSmlhYAWyssBFFAGInwidC

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks