Overview

overview

8

Static

static

1

fdm_x64_setup.exe

windows10-1703-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    fdm_x64_setup.exe

  • Size

    41.2MB

  • Sample

    240415-26xt1aag86

  • MD5

    2dffb2a3f68ce9b506f4aa14ceaf433a

  • SHA1

    5d0008687f2bfecbeca68279cbbfbb9791797e36

  • SHA256

    0c4950be3e7d765fad2a533a75ee0b4a6541a35220624aadbee3d6ac5434cd36

  • SHA512

    6de3cd0c8e67b4bec40d01ee099bbbf450ba8321a23b515cfe50e7ebd64605a920513cb46fd41bce61fcafc246b1b8d27a60c31db56bf182d727cf362c770976

  • SSDEEP

    786432:JmUBy8Nm0t6A4md+ipMJ1sIa/ZpsV29K61cIXhjzpFzrPHyA:9yJb+dyJyI0ZCi1c8hP3zr

Score
8/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      fdm_x64_setup.exe

    • Size

      41.2MB

    • MD5

      2dffb2a3f68ce9b506f4aa14ceaf433a

    • SHA1

      5d0008687f2bfecbeca68279cbbfbb9791797e36

    • SHA256

      0c4950be3e7d765fad2a533a75ee0b4a6541a35220624aadbee3d6ac5434cd36

    • SHA512

      6de3cd0c8e67b4bec40d01ee099bbbf450ba8321a23b515cfe50e7ebd64605a920513cb46fd41bce61fcafc246b1b8d27a60c31db56bf182d727cf362c770976

    • SSDEEP

      786432:JmUBy8Nm0t6A4md+ipMJ1sIa/ZpsV29K61cIXhjzpFzrPHyA:9yJb+dyJyI0ZCi1c8hP3zr

    Score
    8/10
    discoveryevasionpersistence

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks