Overview

overview

10

Static

static

10

ceb7a9204d...34.exe

windows7-x64

9

ceb7a9204d...34.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ceb7a9204dd6d21a26bd8a37e5f6d37bc15c43b26084ff38b932abc849366634

  • Size

    975KB

  • Sample

    231104-xbfvsada7t

  • MD5

    c8a378b8e93855d3b18a40536fb61bd8

  • SHA1

    875ce40d1fbd9db7d6a864380a17407417fd69c2

  • SHA256

    ceb7a9204dd6d21a26bd8a37e5f6d37bc15c43b26084ff38b932abc849366634

  • SHA512

    a96bbab87eebcc2124ccb9aaf9a668e8650b4036fa3e1268a947e2a66799b38f6303fc4f28fabd3c84e02d46aab8b0727c74410911678c0df2110f8ce1be0eb0

  • SSDEEP

    24576:mYCFCdoKbl2cVdrAXIwK3+X5TNkdBAnlXG6+Z1mbXJ:osbl2cVdrKIX+XXkUlXF+Z1I5

Score
10/10
fabookiepersistenceupx

Malware Config

Targets

    • Target

      ceb7a9204dd6d21a26bd8a37e5f6d37bc15c43b26084ff38b932abc849366634

    • Size

      975KB

    • MD5

      c8a378b8e93855d3b18a40536fb61bd8

    • SHA1

      875ce40d1fbd9db7d6a864380a17407417fd69c2

    • SHA256

      ceb7a9204dd6d21a26bd8a37e5f6d37bc15c43b26084ff38b932abc849366634

    • SHA512

      a96bbab87eebcc2124ccb9aaf9a668e8650b4036fa3e1268a947e2a66799b38f6303fc4f28fabd3c84e02d46aab8b0727c74410911678c0df2110f8ce1be0eb0

    • SSDEEP

      24576:mYCFCdoKbl2cVdrAXIwK3+X5TNkdBAnlXG6+Z1mbXJ:osbl2cVdrKIX+XXkUlXF+Z1I5

    Score
    9/10
    persistenceupx

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks