Extracted

Extracted

Extracted

Extracted

• • Target

    6b232f1c2c79c4e701fa0cff8d9459badb912447df00bd7467a89ff6b2b17e0d_JC.exe

  • Size

    1.9MB

  • MD5

    3bf670e5e1c152674b1a6f0fd3ed67f1

  • SHA1

    11c6df477c1d8b95d7c6313f05cd759df34cdc4e

  • SHA256

    6b232f1c2c79c4e701fa0cff8d9459badb912447df00bd7467a89ff6b2b17e0d

  • SHA512

    3cae3752e25a268842a91e87d7dc721f9aee7059e06bcd3e7d6aa90ec6d1b2fe59cad62963f452bbe850af31a2710dd429bad436e10756857ec90fa21bdbb968

  • SSDEEP

    49152:/jdg0nPwhegnBrxZPlH/+ui3T4Ga0e0MTDD4yfYyHs8Xu3/:720nPcnZxZPZgeccD4yfnn+/

  Score

  10^/10

  persistenceupxdiscovery

  • Contacts a large (902) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4