f3d9f86ad6edd9e597c39fc1542b81b1297e98d80148ca6e448dd3bdd08bf8b6 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

4015be0e49...4f.exe

windows7-x64

4015be0e49...4f.exe

windows10-2004-x64

Sharing

General

Target

4015be0e49c809a29e861b509467854f
Size

4.3MB
Sample

240104-gsxa4aceg8
MD5

4015be0e49c809a29e861b509467854f
SHA1

ae005b39667c0b51c329de64702e4852d0f89643
SHA256

f3d9f86ad6edd9e597c39fc1542b81b1297e98d80148ca6e448dd3bdd08bf8b6
SHA512

a3116d07109dfc5372b5c468ec2c8af2af0e5f77cb27d6c9a30acb611b371710df2426d8793bf98958a66ed9134ccca6f8be73f4b72adb77423ffc03767c8055
SSDEEP

98304:Mmb0qw6nTOV1Q3BmBNt2wAILYeVk6ja3frHG:Dbu6nKV1QcNkI8fDG

Score

10^/10

evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4015be0e49c809a29e861b509467854f.exe

Resource

win7-20231129-en

evasion persistence trojan upx

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

4015be0e49c809a29e861b509467854f.exe

Resource

win10v2004-20231215-en

evasion trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  4015be0e49c809a29e861b509467854f
- Size
  
  4.3MB
- MD5
  
  4015be0e49c809a29e861b509467854f
- SHA1
  
  ae005b39667c0b51c329de64702e4852d0f89643
- SHA256
  
  f3d9f86ad6edd9e597c39fc1542b81b1297e98d80148ca6e448dd3bdd08bf8b6
- SHA512
  
  a3116d07109dfc5372b5c468ec2c8af2af0e5f77cb27d6c9a30acb611b371710df2426d8793bf98958a66ed9134ccca6f8be73f4b72adb77423ffc03767c8055
- SSDEEP
  
  98304:Mmb0qw6nTOV1Q3BmBNt2wAILYeVk6ja3frHG:Dbu6nKV1QcNkI8fDG
Score

10^/10

evasion persistence trojan upx
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Blocklisted process makes network request
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojanupx

behavioral2

evasiontrojanupx

© 2018-2025

Terms | Privacy