Overview

overview

7

Static

static

7

package.7z

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    package.7z

  • Size

    112.7MB

  • Sample

    240605-nqscpaec81

  • MD5

    64ddd3a9cd038da7d07a5f9995d0070b

  • SHA1

    30981a8a5542e594d4f7c8e9cb02c544b713df0b

  • SHA256

    f8d1a2f01752aec664643ded673a391cacf7c880c09d6469e4ae64674804b025

  • SHA512

    2d74c047be536937097d3a76d881a13252947c5cbfb4bb915f67a3677ce82dbf78ee5466a11d277a62ebb4c226849ae0474e89349b6fc4cd370014472569962f

  • SSDEEP

    3145728:G80fQDPHUlVpWUVY6l8gbTkWXadyHGGDXK5kI:GdfQqSVWq0mGDXUkI

Score
7/10
agilenetlinkqr

Malware Config

Targets

    • Target

      package.7z

    • Size

      112.7MB

    • MD5

      64ddd3a9cd038da7d07a5f9995d0070b

    • SHA1

      30981a8a5542e594d4f7c8e9cb02c544b713df0b

    • SHA256

      f8d1a2f01752aec664643ded673a391cacf7c880c09d6469e4ae64674804b025

    • SHA512

      2d74c047be536937097d3a76d881a13252947c5cbfb4bb915f67a3677ce82dbf78ee5466a11d277a62ebb4c226849ae0474e89349b6fc4cd370014472569962f

    • SSDEEP

      3145728:G80fQDPHUlVpWUVY6l8gbTkWXadyHGGDXK5kI:GdfQqSVWq0mGDXUkI

    Score
    7/10
    agilenet

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks