Overview

overview

10

Static

static

10

20b5ecf5e5...3f.exe

windows7-x64

9

20b5ecf5e5...3f.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20b5ecf5e5871f282ce3ae72870ceb77d5fed1af9383cc3fb52835d116aaec3f

  • Size

    160KB

  • Sample

    240408-x2pwdahe39

  • MD5

    1e6391be5e36af6623bed1899bf420b6

  • SHA1

    87dbfd001d7b059f29de7bb3b33793148725e925

  • SHA256

    20b5ecf5e5871f282ce3ae72870ceb77d5fed1af9383cc3fb52835d116aaec3f

  • SHA512

    63bdd925fd8af8d38912f652b5e40ab4c86e417361e33e8d7c370159f7a28b9f216cd7ba74100606f3c586345f287b2399b17c1821312dd8f7bab2b17ceed8c8

  • SSDEEP

    1536:kVdmQr3Z5IfQmv81aypP1s3yX+tlehTz5:008JOfQm01F9s3yX+fehTt

Score
10/10
evasionupx

Malware Config

Targets

    • Target

      20b5ecf5e5871f282ce3ae72870ceb77d5fed1af9383cc3fb52835d116aaec3f

    • Size

      160KB

    • MD5

      1e6391be5e36af6623bed1899bf420b6

    • SHA1

      87dbfd001d7b059f29de7bb3b33793148725e925

    • SHA256

      20b5ecf5e5871f282ce3ae72870ceb77d5fed1af9383cc3fb52835d116aaec3f

    • SHA512

      63bdd925fd8af8d38912f652b5e40ab4c86e417361e33e8d7c370159f7a28b9f216cd7ba74100606f3c586345f287b2399b17c1821312dd8f7bab2b17ceed8c8

    • SSDEEP

      1536:kVdmQr3Z5IfQmv81aypP1s3yX+tlehTz5:008JOfQm01F9s3yX+fehTt

    Score
    9/10
    evasionupx

    • Detects Windows executables referencing non-Windows User-Agents

    • UPX dump on OEP (original entry point)

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks