Extracted

• • Target

    1236c0ef970171094fba3b7895a4d3d9.exe

  • Size

    37KB

  • MD5

    1236c0ef970171094fba3b7895a4d3d9

  • SHA1

    bca356e243b57232faabd82aaf1b94e9e620ce82

  • SHA256

    c9aa5dc253264f3c11f4c87187ed9003bb83fb9382693aef3fdce55ac6f99cc6

  • SHA512

    d4c56182e4206972bcd084f3e89bdc55c9f8267be7573840d64cb3301c044a8dfced474d024af78487ef0e30eb3837f02a059d409142481399d90cc8a77349fd

  • SSDEEP

    384:QuSvEiTbTvpWNcZ0y8fvCv3v3cLkacJE0rAF+rMRTyN/0L+EcoinblneHQM3epzx:VS7TZ38fvCv3E1cprM+rMRa8NuUpit

  Score

  8^/10

  evasionpersistence

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2