General

  • Target

    upx.exe

  • Size

    74.7MB

  • Sample

    231124-v3t6dada55

  • MD5

    03cb3938e600d9c6ed31d4f35be0ccb1

  • SHA1

    a58aa42599d78eec89d9d910df26299c3b6764f7

  • SHA256

    8352859c1c13bdffab501cfc0b14d2b97afad78634ea3fc1771049ce4c55a5a6

  • SHA512

    327dcfe40782d6a7b5c2a661610729f1394389fd9dbfa37c2c77ce1a34bd99f02fe040e16b5fa04003eb524e7b8e55502ebc327f60830bdd9f0f53531d2bce4c

  • SSDEEP

    1572864:q22MLeQxH0FSk8IpG7V+VPhqGGE7XQHUzvWspyppiZzI+hR1sW8pZcJTCp:PZLe6UFSkB05awGPQ0SMg2zd7spemp

Malware Config

Targets

    • Target

      upx.exe

    • Size

      74.7MB

    • MD5

      03cb3938e600d9c6ed31d4f35be0ccb1

    • SHA1

      a58aa42599d78eec89d9d910df26299c3b6764f7

    • SHA256

      8352859c1c13bdffab501cfc0b14d2b97afad78634ea3fc1771049ce4c55a5a6

    • SHA512

      327dcfe40782d6a7b5c2a661610729f1394389fd9dbfa37c2c77ce1a34bd99f02fe040e16b5fa04003eb524e7b8e55502ebc327f60830bdd9f0f53531d2bce4c

    • SSDEEP

      1572864:q22MLeQxH0FSk8IpG7V+VPhqGGE7XQHUzvWspyppiZzI+hR1sW8pZcJTCp:PZLe6UFSkB05awGPQ0SMg2zd7spemp

    • Enumerates VirtualBox DLL files

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks