Overview

overview

6

Static

static

1

winprofile

windows7-x64

5

winprofile

windows10-1703-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target

    f2ede43bef79229eb740115e26bb9f7a15ec632259733b9c5e3f88437177ab8c

  • Size

    2.2MB

  • Sample

    230820-fgf93add67

  • MD5

    9bb84cff298b15a8fb452107c1d379a3

  • SHA1

    acd8bf7b6b4f7168c1d77d1658f0237b78d369df

  • SHA256

    f2ede43bef79229eb740115e26bb9f7a15ec632259733b9c5e3f88437177ab8c

  • SHA512

    6f020b37025232bbccc96d8325c9520e60e260cca2321bd83cf91906a2e7eae174753fb63ed33195979f517efa58730b26ef61632653030b9c58e5af40a2da9b

  • SSDEEP

    24576:mtW9grf3C1TCHrvQxrze3Ttw/PH4Xll3K+pzPxpsHO9iZRVG+uk1izGAzoS6wpLW:mPfC1TCHrgyTtsPH4HJPcWoUBW

Score
6/10
persistence

Malware Config

Targets

    • Target

      f2ede43bef79229eb740115e26bb9f7a15ec632259733b9c5e3f88437177ab8c

    • Size

      2.2MB

    • MD5

      9bb84cff298b15a8fb452107c1d379a3

    • SHA1

      acd8bf7b6b4f7168c1d77d1658f0237b78d369df

    • SHA256

      f2ede43bef79229eb740115e26bb9f7a15ec632259733b9c5e3f88437177ab8c

    • SHA512

      6f020b37025232bbccc96d8325c9520e60e260cca2321bd83cf91906a2e7eae174753fb63ed33195979f517efa58730b26ef61632653030b9c58e5af40a2da9b

    • SSDEEP

      24576:mtW9grf3C1TCHrvQxrze3Ttw/PH4Xll3K+pzPxpsHO9iZRVG+uk1izGAzoS6wpLW:mPfC1TCHrgyTtsPH4HJPcWoUBW

    Score
    6/10
    persistence

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks