Overview

overview

10

Static

static

10

e9b52f3662...fb.exe

windows7-x64

9

e9b52f3662...fb.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e9b52f3662e306cd55401b5e755e8eff28d185e9586207cb696299f0277f12fb

  • Size

    15KB

  • Sample

    240604-e8wy6adh74

  • MD5

    b525d4cdf2c87f49308c0ff102831385

  • SHA1

    4f72728c2fc111be59fd8b1f2b6bd1bca0edd8ab

  • SHA256

    e9b52f3662e306cd55401b5e755e8eff28d185e9586207cb696299f0277f12fb

  • SHA512

    12f8407251641216131f4d05493a7e1e7c37cca245aef5169f9be05289bd776fc0a3c4d1c8dd8fc1ecb64ce0f7afda0d3f12233ca7e285a85ace9b2db2e867c0

  • SSDEEP

    384:IO3qdXlIQV0YXd45xuYiMcRWnPbeVGWLp:IO3EVdV0YXd4DuicNV3F

Score
10/10
evasionupx

Malware Config

Targets

    • Target

      e9b52f3662e306cd55401b5e755e8eff28d185e9586207cb696299f0277f12fb

    • Size

      15KB

    • MD5

      b525d4cdf2c87f49308c0ff102831385

    • SHA1

      4f72728c2fc111be59fd8b1f2b6bd1bca0edd8ab

    • SHA256

      e9b52f3662e306cd55401b5e755e8eff28d185e9586207cb696299f0277f12fb

    • SHA512

      12f8407251641216131f4d05493a7e1e7c37cca245aef5169f9be05289bd776fc0a3c4d1c8dd8fc1ecb64ce0f7afda0d3f12233ca7e285a85ace9b2db2e867c0

    • SSDEEP

      384:IO3qdXlIQV0YXd45xuYiMcRWnPbeVGWLp:IO3EVdV0YXd4DuicNV3F

    Score
    9/10
    evasionupx

    • Detects Windows executables referencing non-Windows User-Agents

    • UPX dump on OEP (original entry point)

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks