Extracted

• • Target

    CompatibilityCheck.exe

  • Size

    37KB

  • MD5

    0c84829a79c06e88510607526990391e

  • SHA1

    63970a42f5b779c1f0f8d95d493317917b0bd46d

  • SHA256

    6f9b61794c9169a8860fb74e2cc0253b0bc283327b6485f799265f702a67c921

  • SHA512

    85638191fee2b456e601487aff23bc5dccbfd24e74970e5f1d8fbdad633a3d31208887f682debf1fd2abcec6e36c50e74b6da30c660dfa0bc0471e7ef8c98f40

  • SSDEEP

    384:p6hCpb2iKrL4y4Oo49qylTKbWstSXHasW4TkrAF+rMRTyN/0L+EcoinblneHQM3Y:oCdi/s89ZlTKtSK94YrM+rMRa8NuS2t

  Score

  8^/10

  evasionpersistence

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1