Overview

overview

10

Static

static

10

87415a2818...19.exe

windows7-x64

10

87415a2818...19.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    87415a2818cb3e1b546e04debec1cd8e942b3afd981f65c51436e00ef98a5619

  • Size

    1.5MB

  • Sample

    240313-z3m5aaha8x

  • MD5

    c3f48478749c72aab8a873ae185c4001

  • SHA1

    b202bae63455d852a69f2cb39c5d237555a5c6c0

  • SHA256

    87415a2818cb3e1b546e04debec1cd8e942b3afd981f65c51436e00ef98a5619

  • SHA512

    3b0e8088d48faf0f1278d8c18201da8c2ee79e48aff9141f25fb632475436bf5ecf9aa355bb45e031f0e103ca68a0242f39338b62b1a8fee87915d384e5876c6

  • SSDEEP

    24576:PFOalsqLY/SQe/JGy8U6epCdC4B4K8cvKBUlrVI3r+B4lz/i/ywNRhjSFOf:tZYARGyLmCq4VciKlr2b+EjmzSo

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      87415a2818cb3e1b546e04debec1cd8e942b3afd981f65c51436e00ef98a5619

    • Size

      1.5MB

    • MD5

      c3f48478749c72aab8a873ae185c4001

    • SHA1

      b202bae63455d852a69f2cb39c5d237555a5c6c0

    • SHA256

      87415a2818cb3e1b546e04debec1cd8e942b3afd981f65c51436e00ef98a5619

    • SHA512

      3b0e8088d48faf0f1278d8c18201da8c2ee79e48aff9141f25fb632475436bf5ecf9aa355bb45e031f0e103ca68a0242f39338b62b1a8fee87915d384e5876c6

    • SSDEEP

      24576:PFOalsqLY/SQe/JGy8U6epCdC4B4K8cvKBUlrVI3r+B4lz/i/ywNRhjSFOf:tZYARGyLmCq4VciKlr2b+EjmzSo

    Score
    10/10
    evasionpersistencetrojanupx

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks