Extracted

Extracted

Extracted

• • Target
    bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
  • Size 1.9MB
  • SHA256 bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8
  • MD5 bab406ad3b0603a45625755ffbccce49
  • SHA1 7ce0bd31c68c5b54854098acad195b7a8d804939
  • SHA512 a85ca2bc5ab42f8d32856a87c665b66df7d8e1c1ebbb143015d06fcc1bddba1faf684e2ee1d2a572f5ed04edf3a061837c293b5c1e3d2214864b90d8a68d25cc
  • SSDEEP 49152:hgWDef4IXn7EvfNf+x83OeG5ztpAEq2pe2n9SCtQV:hvo49fk83ONztiEqz2nA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  persistenceupxdiscovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4