General

  • Target

    Patcher.exe

  • Size

    18.4MB

  • Sample

    231230-y5dg7adagk

  • MD5

    fa3f147700c61e0f9d3c325703e5060d

  • SHA1

    48fe2e73adec86d1664070f6169a66d197579617

  • SHA256

    ecbd81342050f7271e98c4ceaefd1f23fbf743b12648bb5d3c3bbd864af1ef57

  • SHA512

    152b403e1a5ff51fe867b4ecbd440a35802206a76e8e8820c1a00d0a09c6c1df324aab32c27b8a5c1ec094492a8ae5425822614e086fdb08adaab64f5512bdab

  • SSDEEP

    393216:RFAlnzYXaPiet1256aOshouIkPbtRL54+R8AbRIXC0422x3w:klzYXaPier2cfwouftRL24pQM0

Score
7/10

Malware Config

Targets

    • Target

      Patcher.exe

    • Size

      18.4MB

    • MD5

      fa3f147700c61e0f9d3c325703e5060d

    • SHA1

      48fe2e73adec86d1664070f6169a66d197579617

    • SHA256

      ecbd81342050f7271e98c4ceaefd1f23fbf743b12648bb5d3c3bbd864af1ef57

    • SHA512

      152b403e1a5ff51fe867b4ecbd440a35802206a76e8e8820c1a00d0a09c6c1df324aab32c27b8a5c1ec094492a8ae5425822614e086fdb08adaab64f5512bdab

    • SSDEEP

      393216:RFAlnzYXaPiet1256aOshouIkPbtRL54+R8AbRIXC0422x3w:klzYXaPier2cfwouftRL24pQM0

    Score
    7/10
    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Target

      Obfuscated.pyc

    • Size

      73KB

    • MD5

      3a62ac6fec8faf6b2bfd22329b388258

    • SHA1

      85a45c80701a4ed1180c257432cfb9faa29f53c0

    • SHA256

      4f37de313db978aaba630dc57fb33a8083ecd1d0f7bb2c25cf5d4360ecd0399a

    • SHA512

      6279cd9edda1bf55c160206caa2ea6d4a0ff5a39bb29821e3d2e27a333b608a1df2872a2e30552e5c8f13b21fedd83b1a0afc06225afa8ef185477835eeaefb2

    • SSDEEP

      768:XRQ4/ch1bJuzBI13yTDr8CVc2D6txtdBP+FRqRQBvk4QWci6Qqb8:XzoOG13yT/Tn6Z+FRqRm84QWci6Qqg

    Score
    1/10

MITRE ATT&CK Matrix

Tasks