Overview

overview

9

Static

static

3

8b0bf6a0de...db.exe

windows7-x64

9

8b0bf6a0de...db.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b0bf6a0debdec1d7f993968aa497f55ed4c885885d1d620ed5646fbe0a4f8db

  • Size

    279KB

  • Sample

    240308-zpmxcsgg3t

  • MD5

    f3978933721334860ee9d963894dc005

  • SHA1

    940ea8bd5fe36b434943dda534ef0212c63df68e

  • SHA256

    8b0bf6a0debdec1d7f993968aa497f55ed4c885885d1d620ed5646fbe0a4f8db

  • SHA512

    9d5ab831302e90f313cb0469864ce9f09d0055c62d8ec5408e60d126c33d4220916289229bda2757b98afb955992fdbb2580a37f8791db44a8f64ffb84dfa9f3

  • SSDEEP

    6144:lGj00q1nqfq+qd5nz7fwyxJKnikRgqxZzBV+UdvrEFp7hKnD:l8oGlq/nznHoxlBjvrEH7aD

Score
9/10
persistenceupx

Malware Config

Targets

    • Target

      8b0bf6a0debdec1d7f993968aa497f55ed4c885885d1d620ed5646fbe0a4f8db

    • Size

      279KB

    • MD5

      f3978933721334860ee9d963894dc005

    • SHA1

      940ea8bd5fe36b434943dda534ef0212c63df68e

    • SHA256

      8b0bf6a0debdec1d7f993968aa497f55ed4c885885d1d620ed5646fbe0a4f8db

    • SHA512

      9d5ab831302e90f313cb0469864ce9f09d0055c62d8ec5408e60d126c33d4220916289229bda2757b98afb955992fdbb2580a37f8791db44a8f64ffb84dfa9f3

    • SSDEEP

      6144:lGj00q1nqfq+qd5nz7fwyxJKnikRgqxZzBV+UdvrEFp7hKnD:l8oGlq/nznHoxlBjvrEH7aD

    Score
    9/10
    upxpersistence

    • UPX dump on OEP (original entry point)

    • Modifies AppInit DLL entries

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks