General

  • Target

    upx.exe

  • Size

    74.7MB

  • Sample

    231125-rtsdmsbe9z

  • MD5

    2f99ee2179efde903a59fe22712645bb

  • SHA1

    597d3d3b0eb013d119d53688bfb7786401920d6e

  • SHA256

    b77532355b62247caf9996282ab8cf9fce26ff5a6414c4278ca906b76f9b340e

  • SHA512

    7eaeed1627701a0af1332504fc74e2130f85040dd7fd2c5b9fc87aeacc144af2b683712f45b238db4d50df0c2977f5ec9fab61ae930e5313743c1cd4fcf30ef7

  • SSDEEP

    1572864:mV2MLeQxH0FSk8IpG7V+VPhqGGE7XQHUzvWspyppiZzI+hR1sWAvvZq70aq:EZLe6UFSkB05awGPQ0SMg2zd7sLv2Nq

Malware Config

Targets

    • Target

      upx.exe

    • Size

      74.7MB

    • MD5

      2f99ee2179efde903a59fe22712645bb

    • SHA1

      597d3d3b0eb013d119d53688bfb7786401920d6e

    • SHA256

      b77532355b62247caf9996282ab8cf9fce26ff5a6414c4278ca906b76f9b340e

    • SHA512

      7eaeed1627701a0af1332504fc74e2130f85040dd7fd2c5b9fc87aeacc144af2b683712f45b238db4d50df0c2977f5ec9fab61ae930e5313743c1cd4fcf30ef7

    • SSDEEP

      1572864:mV2MLeQxH0FSk8IpG7V+VPhqGGE7XQHUzvWspyppiZzI+hR1sWAvvZq70aq:EZLe6UFSkB05awGPQ0SMg2zd7sLv2Nq

    • Enumerates VirtualBox DLL files

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks