Overview

overview

7

Static

static

3

aad4997c06...JC.exe

windows7-x64

7

aad4997c06...JC.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aad4997c066612869506d530a_JC.exe

  • Size

    175KB

  • Sample

    230728-vqhxksfb3z

  • MD5

    c12fbddc2c7ae2eb6b4431bb52646d4d

  • SHA1

    9f7301a3f03277b684239d5d7f7cddac8d8cd0dd

  • SHA256

    aad4997c066612869506d530ae0715ea9afcb84289731fe7150e71d463cc0785

  • SHA512

    b8e0392bc8c56edce634e3b93fb76cf550ca111654761a4ad51d85c932f28539c28d8afb92c1fedffc5853982715c704c461199d4043d78845fa0db57caf28b4

  • SSDEEP

    3072:nwDijpS4DbYcr8bsDWMqE0I/PgQsU9+fFmll+TfvHpdLcxydWebIJ3yY7qzNwve0:nFPeBU/PgQsOWzLgAdE3y0qhYe0

Score
7/10

Malware Config

Targets

    • Target

      aad4997c066612869506d530a_JC.exe

    • Size

      175KB

    • MD5

      c12fbddc2c7ae2eb6b4431bb52646d4d

    • SHA1

      9f7301a3f03277b684239d5d7f7cddac8d8cd0dd

    • SHA256

      aad4997c066612869506d530ae0715ea9afcb84289731fe7150e71d463cc0785

    • SHA512

      b8e0392bc8c56edce634e3b93fb76cf550ca111654761a4ad51d85c932f28539c28d8afb92c1fedffc5853982715c704c461199d4043d78845fa0db57caf28b4

    • SSDEEP

      3072:nwDijpS4DbYcr8bsDWMqE0I/PgQsU9+fFmll+TfvHpdLcxydWebIJ3yY7qzNwve0:nFPeBU/PgQsOWzLgAdE3y0qhYe0

    Score
    7/10

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks