Extracted

• • Target

    e6df60c235ce89a2d376b3708f8565e0c045020d08e0883ab726bebcd09086ba

  • Size

    1.9MB

  • MD5

    7fd0e978ae68613a96a07194d82ff058

  • SHA1

    25347be4f94a784cb261229109261aba61853308

  • SHA256

    e6df60c235ce89a2d376b3708f8565e0c045020d08e0883ab726bebcd09086ba

  • SHA512

    d8e17eb7737eb4469e19442769c74a4f25d44c75e53c1ff9483b3e76cd93ebb0dc530b3c6e6eed6753186bdff2c1c7af3d170ac69d1a8ca21f949fcdda7daa5e

  • SSDEEP

    24576:8aptmBr8CsPIejX7NsxexfMOSUH2XydxRY18S55ysdCG7QQdhph8BwvyM86:JmBr8JPxDH2XydxRY/5bdN7QQ8BWyX6

  Score

  10^/10

  persistenceupx

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4behavioral5