Overview

overview

8

Static

static

3

Photo.scr

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Photo.scr

  • Size

    5.9MB

  • Sample

    231008-rltazacg6y

  • MD5

    5616a3471565d34d779b5b3d0520bb70

  • SHA1

    42df726156bee4a54ea328bd72a659602ab7d03e

  • SHA256

    9194b57673209c8534888f61b0cdefa34f463ae50cd78f72ab2b3348220baaf9

  • SHA512

    21f70509a14eaf5dd63b533df612b64b07ff0e991d3a4ba3c17c9618bc952bccb61e189c04ca234fb374d2c75779aff108fd9bc7c44857e4034887b861058c1e

  • SSDEEP

    98304:RLbSThOfTCiFBXmfFs+JhEpCVoR8oMEOJ6Ty3RvX+UGD823FUuzmH:tBfTCiUs0VSLOJgyBGUA8Ch8

Score
8/10
discoveryevasionpyinstallerupx

Malware Config

Targets

    • Target

      Photo.scr

    • Size

      5.9MB

    • MD5

      5616a3471565d34d779b5b3d0520bb70

    • SHA1

      42df726156bee4a54ea328bd72a659602ab7d03e

    • SHA256

      9194b57673209c8534888f61b0cdefa34f463ae50cd78f72ab2b3348220baaf9

    • SHA512

      21f70509a14eaf5dd63b533df612b64b07ff0e991d3a4ba3c17c9618bc952bccb61e189c04ca234fb374d2c75779aff108fd9bc7c44857e4034887b861058c1e

    • SSDEEP

      98304:RLbSThOfTCiFBXmfFs+JhEpCVoR8oMEOJ6Ty3RvX+UGD823FUuzmH:tBfTCiUs0VSLOJgyBGUA8Ch8

    Score
    8/10
    discoveryevasionpyinstallerupx

    • Modifies Windows Firewall

      evasion

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks