General

  • Target

    fragment.exe

  • Size

    19.2MB

  • Sample

    230828-bln39agc3w

  • MD5

    8bbe876f53623102e47b5a064d462c3e

  • SHA1

    075fec0f4cc1434f249f7d60b49b520370d1d36d

  • SHA256

    8675b3158ff509ccc2fbbf768c2b8ea5435626e9383b474ae2a08a303bc07efe

  • SHA512

    ccd538884392b71359c9aca4d2b8fcbeb44950eadc1c083ef7b9bd210e7f4995c492581f5b801e69ace6f75fa335e59c6a6dfee6437adc71624ceab916918feb

  • SSDEEP

    393216:Oh3nJWQDoYNLOPhVOshouIkPdtRL5u26YwX6lCOd/V:Oh3EQMYduhwwouJtRLYWvb

Score
7/10

Malware Config

Targets

    • Target

      fragment.exe

    • Size

      19.2MB

    • MD5

      8bbe876f53623102e47b5a064d462c3e

    • SHA1

      075fec0f4cc1434f249f7d60b49b520370d1d36d

    • SHA256

      8675b3158ff509ccc2fbbf768c2b8ea5435626e9383b474ae2a08a303bc07efe

    • SHA512

      ccd538884392b71359c9aca4d2b8fcbeb44950eadc1c083ef7b9bd210e7f4995c492581f5b801e69ace6f75fa335e59c6a6dfee6437adc71624ceab916918feb

    • SSDEEP

      393216:Oh3nJWQDoYNLOPhVOshouIkPdtRL5u26YwX6lCOd/V:Oh3EQMYduhwwouJtRLYWvb

    Score
    7/10
    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Target

      fragment.pyc

    • Size

      49KB

    • MD5

      83ef755c82493970454d684b17e267da

    • SHA1

      858b6ff36af082786b8e586b46ed56f8502f2cc5

    • SHA256

      a158bdbdb76d66d2e6793c273507ca11e69b8c8f607e4207e080964d24975de1

    • SHA512

      2e62cfbb2a118e128410d026bd620a42c18498c2b157b8c74db358f4fdede70bd8d8f257bdafbf9fe960416e88181600d98870081c3c6382d16bea4384d9951d

    • SSDEEP

      1536:t9MWkg+E5uZnK7SBx4Z1ScGF8RDaVqNeDlhLxFUSgeC:3+E5ekSB+pzRDwUaC

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks