Overview

overview

10

Static

static

10

9d98a46e53...0b.exe

windows7-x64

9

9d98a46e53...0b.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b

  • Size

    1.4MB

  • Sample

    231112-te14cahc85

  • MD5

    818b630dbc0561c45e768ffed4331b5b

  • SHA1

    597ff7a6d34c0d514ca865629126b39eb9e496a4

  • SHA256

    9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b

  • SHA512

    11dbd4f2d0b4e5764d7a2c140d3dea7483caa610a6fe765305e6aed15ccacad150396fae4093d7456688400eeeb3529e1d60fec7b924c5167dd29fe8eb8ef19d

  • SSDEEP

    24576:mYCFCdoKbl2cVdrAXIwK3+X5TNkdBAnlXG6+Z1mbXbh/KKlUmpRee:osbl2cVdrKIX+XXkUlXF+Z1Irh/KKlUs

Score
10/10
fabookiepersistenceupx

Malware Config

Targets

    • Target

      9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b

    • Size

      1.4MB

    • MD5

      818b630dbc0561c45e768ffed4331b5b

    • SHA1

      597ff7a6d34c0d514ca865629126b39eb9e496a4

    • SHA256

      9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b

    • SHA512

      11dbd4f2d0b4e5764d7a2c140d3dea7483caa610a6fe765305e6aed15ccacad150396fae4093d7456688400eeeb3529e1d60fec7b924c5167dd29fe8eb8ef19d

    • SSDEEP

      24576:mYCFCdoKbl2cVdrAXIwK3+X5TNkdBAnlXG6+Z1mbXbh/KKlUmpRee:osbl2cVdrKIX+XXkUlXF+Z1Irh/KKlUs

    Score
    9/10
    persistenceupx

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks