Overview

overview

7

Static

static

3

aad4997c06...85.exe

windows7-x64

7

aad4997c06...85.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c12fbddc2c7ae2eb6b4431bb52646d4d.bin

  • Size

    162KB

  • Sample

    230729-b9dbnaae56

  • MD5

    3a82d69511b9f0e07451e3bfd11acf96

  • SHA1

    9e8837ec89c6089f319b96551bbea83a64b9bcd3

  • SHA256

    b3bd045f0285f1a669110075bfa6e5a20eb8229766c3a2995c05505d761f5e2d

  • SHA512

    8999c7a0615cda4a867ef5a34baba38d618efbbd3a47cb9becc63acc4313b0941e0f4aa64d4324fdef1693a5496ed0f10ca618b491f133ac89cc02a373fe9be9

  • SSDEEP

    3072:USjgrwJILWscSTbd2B5SyWCZjQDJofdJ8uEBVZbW/c7zr0HNstT7cu5NP:UmiQILWsD/sS1DJ8gtftWIreNwTw0NP

Score
7/10

Malware Config

Targets

    • Target

      aad4997c066612869506d530ae0715ea9afcb84289731fe7150e71d463cc0785.exe

    • Size

      175KB

    • MD5

      c12fbddc2c7ae2eb6b4431bb52646d4d

    • SHA1

      9f7301a3f03277b684239d5d7f7cddac8d8cd0dd

    • SHA256

      aad4997c066612869506d530ae0715ea9afcb84289731fe7150e71d463cc0785

    • SHA512

      b8e0392bc8c56edce634e3b93fb76cf550ca111654761a4ad51d85c932f28539c28d8afb92c1fedffc5853982715c704c461199d4043d78845fa0db57caf28b4

    • SSDEEP

      3072:nwDijpS4DbYcr8bsDWMqE0I/PgQsU9+fFmll+TfvHpdLcxydWebIJ3yY7qzNwve0:nFPeBU/PgQsOWzLgAdE3y0qhYe0

    Score
    7/10

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks