Extracted

• • Target
    06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3.bin
  • Size 7.8MB
  • SHA256 06f5ae2998205719e3541415641a8afc2f5d6877b50c860df066e0e95c7ed3f3
  • MD5 03b9dd8b1e16ad5c2a605ad6b18493a7
  • SHA1 725f4473d8e09a8a9fcad2e8900dfb74623d4f18
  • SHA512 8c5c077bd7575483b3601221b77e5b49b9acb7181fe73173dd5879cd19b6d517b5f2454390884ea87490da72cb2e37b5d476132f96415a68b209ce740c7b1c4f
  • SSDEEP 196608:LIRcbH4jSteTGvwxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:LdHsfuwxwZ6v1CPwDv3uFteg2EeJUO9E
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  upx

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3behavioral4