Overview

overview

10

Static

static

10

0971be6270...2d.exe

windows7-x64

9

0971be6270...2d.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0971be6270078a980c8ad595ddba444b8b165bc43501d9ddb23a2476518c1a2d

  • Size

    2.6MB

  • Sample

    231115-q2e8lscd4y

  • MD5

    82234d2ba7d8d68fdcb6b130e1e89878

  • SHA1

    fd9a78f517cd4d14416a50e1be1330cfa7cfb4ae

  • SHA256

    0971be6270078a980c8ad595ddba444b8b165bc43501d9ddb23a2476518c1a2d

  • SHA512

    dfa91063c0c1d04b0b8bcfc7e658dc5f892d3637c46e385a253cc2e1b879b07912c23445fd6a28fbd7e7cf5e9a92e01b904fb57fdd094a7189181e52eb2ec266

  • SSDEEP

    49152:osbl2cVdrKIX+XXkUlXF+Z1Io14VZpg5/yjVBMZ/MEvCgyVXHMqpWcKO7870:jKy+HpsZ1dl5/yjG/MZMcW0787

Score
10/10
fabookiepersistenceupx

Malware Config

Targets

    • Target

      0971be6270078a980c8ad595ddba444b8b165bc43501d9ddb23a2476518c1a2d

    • Size

      2.6MB

    • MD5

      82234d2ba7d8d68fdcb6b130e1e89878

    • SHA1

      fd9a78f517cd4d14416a50e1be1330cfa7cfb4ae

    • SHA256

      0971be6270078a980c8ad595ddba444b8b165bc43501d9ddb23a2476518c1a2d

    • SHA512

      dfa91063c0c1d04b0b8bcfc7e658dc5f892d3637c46e385a253cc2e1b879b07912c23445fd6a28fbd7e7cf5e9a92e01b904fb57fdd094a7189181e52eb2ec266

    • SSDEEP

      49152:osbl2cVdrKIX+XXkUlXF+Z1Io14VZpg5/yjVBMZ/MEvCgyVXHMqpWcKO7870:jKy+HpsZ1dl5/yjG/MZMcW0787

    Score
    9/10
    persistenceupx

    • Nirsoft

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks