Overview

overview

9

Static

static

7

dcf1c76b4c...e2.exe

windows7-x64

9

dcf1c76b4c...e2.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dcf1c76b4cb0fa5dade95544bc704ee2

  • Size

    1.4MB

  • Sample

    240325-b83vxscg24

  • MD5

    dcf1c76b4cb0fa5dade95544bc704ee2

  • SHA1

    c3a7e2355af9688be570175b05d86dd568180a32

  • SHA256

    2733f90b77a0b67f033a5188ca6d1a46e754dff03b5656dafb034d523e121c92

  • SHA512

    42723a99564bedb335926c71ba2e2f0442ea31ceec25aa79cf9bf2d4fdd76f3abefa3aa834eba4c7d258cea23393aef05d7cbf04297074f36d8ab6e19e9f167a

  • SSDEEP

    24576:b6yJMY9UFoRDhkeYM1jJR97zUbia9JVe0hs5WfBiERJchVML1bT6E7:GY9UORVOM1jJHzaiape0hsABFRJch6Lv

Score
9/10
rezer0upx

Malware Config

Targets

    • Target

      dcf1c76b4cb0fa5dade95544bc704ee2

    • Size

      1.4MB

    • MD5

      dcf1c76b4cb0fa5dade95544bc704ee2

    • SHA1

      c3a7e2355af9688be570175b05d86dd568180a32

    • SHA256

      2733f90b77a0b67f033a5188ca6d1a46e754dff03b5656dafb034d523e121c92

    • SHA512

      42723a99564bedb335926c71ba2e2f0442ea31ceec25aa79cf9bf2d4fdd76f3abefa3aa834eba4c7d258cea23393aef05d7cbf04297074f36d8ab6e19e9f167a

    • SSDEEP

      24576:b6yJMY9UFoRDhkeYM1jJR97zUbia9JVe0hs5WfBiERJchVML1bT6E7:GY9UORVOM1jJHzaiape0hsABFRJch6Lv

    Score
    9/10
    rezer0upx

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks