Overview

overview

10

Static

static

10

dfdebc898d...b0.exe

windows7-x64

9

dfdebc898d...b0.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfdebc898db441d79f5560d86a4f026aaf31cde1b3627f1c3399382e9322eeb0

  • Size

    1.1MB

  • Sample

    231109-ygv3bscg6v

  • MD5

    0aabb5c303781df55b4c12d9406b958d

  • SHA1

    f395673a26d1a1ce7a45a4d9c410fa1a1b34db86

  • SHA256

    dfdebc898db441d79f5560d86a4f026aaf31cde1b3627f1c3399382e9322eeb0

  • SHA512

    c4dd8bdb3064653b216cdc06eb3d3863683029076a38fe85e80f2db88111947a289cca57680ca8cd12733d4a353e16c6d379d50f945a2c69ab7cff5444f15423

  • SSDEEP

    24576:uYCFCdoKbl2cVdrAXIwK3+X5TNkdBAnlXG6+Z1mbXBYCFLC:gsbl2cVdrKIX+XXkUlXF+Z1IP

Score
10/10
fabookiepersistenceupx

Malware Config

Targets

    • Target

      dfdebc898db441d79f5560d86a4f026aaf31cde1b3627f1c3399382e9322eeb0

    • Size

      1.1MB

    • MD5

      0aabb5c303781df55b4c12d9406b958d

    • SHA1

      f395673a26d1a1ce7a45a4d9c410fa1a1b34db86

    • SHA256

      dfdebc898db441d79f5560d86a4f026aaf31cde1b3627f1c3399382e9322eeb0

    • SHA512

      c4dd8bdb3064653b216cdc06eb3d3863683029076a38fe85e80f2db88111947a289cca57680ca8cd12733d4a353e16c6d379d50f945a2c69ab7cff5444f15423

    • SSDEEP

      24576:uYCFCdoKbl2cVdrAXIwK3+X5TNkdBAnlXG6+Z1mbXBYCFLC:gsbl2cVdrKIX+XXkUlXF+Z1IP

    Score
    9/10
    persistenceupx

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks