fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd

General

Target
fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd
Size 130KB
Sample240605-gxddsagh77
SHA256 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd
MD5 f2e0c9cb37375804884367aa1e41c3f4
SHA1 17b37c227099089d459cb3cb31e564c020b70ba7
SHA512 67f26c6668cddf194b17be72589580bfd12d66c5c821f83014a9072a1d2ca3584d54c88fa8ae6bfd8b561c1e7fa4c7456a145ae9b09d3c58565e4c1f2adbf4f3
SSDEEP 3072:eGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:J1b/UJO0m7Ko5fvfo3R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd
- Size 130KB
- SHA256 fbe4801f5a52d90a70c2be3b92a0f95b2467d5335bb0d8ec8b1b6ef8640341fd
- MD5 f2e0c9cb37375804884367aa1e41c3f4
- SHA1 17b37c227099089d459cb3cb31e564c020b70ba7
- SHA512 67f26c6668cddf194b17be72589580bfd12d66c5c821f83014a9072a1d2ca3584d54c88fa8ae6bfd8b561c1e7fa4c7456a145ae9b09d3c58565e4c1f2adbf4f3
- SSDEEP 3072:eGfAUbd5CR4Up+UPO0ksS7KoD1f2CfUpHzk2r0O:J1b/UJO0m7Ko5fvfo3R
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

evasion persistence upx
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Detects executables built or packed with MPress PE compressor
- UPX dump on OEP (original entry point)
- Disables use of System Restore points
  evasion
- Sets file execution options in registry
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2