Overview

overview

10

Static

static

10

6bf7dfae58...58.exe

windows7-x64

10

6bf7dfae58...58.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6bf7dfae58fad5746134a659dde58aaeb39834ad2b5bd022493581e543166658.exe.compressed

  • Size

    442KB

  • MD5

    91443db3281cc1f6025483b62b23d221

  • SHA1

    f330accd6a228878d3a86ac3ff239deda39263c0

  • SHA256

    41ae96b338f143f382e5cbed6d6b730e847c71bbc0d3453411c122990759d08c

  • SHA512

    0db193a93849c929462a8b19a0b7cc8cbea6ee02ddca3802c36de9189c3dce8da40021d9e26bd4216401a83e1d11e31305769bb60b22cbbbc2adee8aa3805041

  • SSDEEP

    6144:UiMjX3En9o3Chide4wlP5HrJTeRk9TBVH0:Ur3E9bhKeFlPe/

Score
10/10
upx

Malware Config

Signatures

  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 1 IoCs
  • Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
  • UPX dump on OEP (original entry point) 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 6bf7dfae58fad5746134a659dde58aaeb39834ad2b5bd022493581e543166658.exe.compressed
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections