48ee5e003fdd3d8c6b50ffb7931e5562ef3d04b7b411d8cf89118655da5c0e03

Target

39d11a7c0c4286ab2fa318d37cb3c3f3.exe
Size

1.9MB
Sample

240407-lnxhhsad77
MD5

39d11a7c0c4286ab2fa318d37cb3c3f3
SHA1

c18444d8d82b628100ac6d7b33c873884be99897
SHA256

48ee5e003fdd3d8c6b50ffb7931e5562ef3d04b7b411d8cf89118655da5c0e03
SHA512

3b24266cfda84af111551bb35111b1816739ffb971ee9ed26f20d3463abb7e7cc7f301bd29b0fed9f68b40a2e43e8b8fbb3c3776f3ea78eb875e0327f52d5a10
SSDEEP

49152:CeZz2gwNjPDGrcflSdRwwlM2oTPHUcmdfgL:hQg0iyqwwlJyLmB

Score

7^/10

persistence upx

Malware Config

Targets

- Target
  
  39d11a7c0c4286ab2fa318d37cb3c3f3.exe
- Size
  
  1.9MB
- MD5
  
  39d11a7c0c4286ab2fa318d37cb3c3f3
- SHA1
  
  c18444d8d82b628100ac6d7b33c873884be99897
- SHA256
  
  48ee5e003fdd3d8c6b50ffb7931e5562ef3d04b7b411d8cf89118655da5c0e03
- SHA512
  
  3b24266cfda84af111551bb35111b1816739ffb971ee9ed26f20d3463abb7e7cc7f301bd29b0fed9f68b40a2e43e8b8fbb3c3776f3ea78eb875e0327f52d5a10
- SSDEEP
  
  49152:CeZz2gwNjPDGrcflSdRwwlM2oTPHUcmdfgL:hQg0iyqwwlJyLmB
Score

7^/10

persistence upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

UPX packed file

Unexpected DNS network traffic destination

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4