General

  • Target

    FivemAE.exe

  • Size

    16.5MB

  • Sample

    240203-3mbm4aehaq

  • MD5

    d00c2f0b3ffce86e496b8d9be28a41c1

  • SHA1

    4a56414bee960e79203cc437fea4a59c51da7d19

  • SHA256

    14c0e92d72fb2a6afcba06f88bca846d13e78e418661a4203045f52d497a2578

  • SHA512

    9b3024bff2793175640e9c175c10ace4d8d9b0d85d6e15e0d39aabbb16675bdd1f4de21e39ed9eb14bc3b714ece27b147294ce3693319edd0760e98a4ecc4b4c

  • SSDEEP

    393216:fh9S2nnx8qGCPaL+9qzTSCk+7q301JE1bbKXiWCUI:Z9Dnx3M+9q/4301gHFVUI

Score
7/10

Malware Config

Targets

    • Target

      FivemAE.exe

    • Size

      16.5MB

    • MD5

      d00c2f0b3ffce86e496b8d9be28a41c1

    • SHA1

      4a56414bee960e79203cc437fea4a59c51da7d19

    • SHA256

      14c0e92d72fb2a6afcba06f88bca846d13e78e418661a4203045f52d497a2578

    • SHA512

      9b3024bff2793175640e9c175c10ace4d8d9b0d85d6e15e0d39aabbb16675bdd1f4de21e39ed9eb14bc3b714ece27b147294ce3693319edd0760e98a4ecc4b4c

    • SSDEEP

      393216:fh9S2nnx8qGCPaL+9qzTSCk+7q301JE1bbKXiWCUI:Z9Dnx3M+9q/4301gHFVUI

    Score
    7/10
    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Target

      FivemAE.pyc

    • Size

      69KB

    • MD5

      7c7d90bae353f14e203203441b096851

    • SHA1

      f3a00c44ff29ee02ac94f0e3a5649958432aad3e

    • SHA256

      dba2cc0f0244ddd9a64b7d2c3153130f3145a7a2d7b174b643cfe82b62d340b0

    • SHA512

      0f47785072ec7a6abdbaf99f25e4ef1aeeaddc5592785d109fd0e7669cac8262e72b4d83bbc7647277cd3c03ae7b7f42be4d0d633d840b52bc31e5c69b0a1010

    • SSDEEP

      768:6NPS3Irw/gMxvCWUL8OsvPi3K2nFcWAXTxcPdCA79/GleK1AnjdRnrBIdy:6+IrYv+SNxjlJKpVrH

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks