Extracted

• • Target

    dd9db3ce85e04785fc2e509c534f00ed5e5bf42254a282a641f9c8c1a0a535aa.exe

  • Size

    37KB

  • MD5

    19159c6d912eec19d4a91fa9eae85dae

  • SHA1

    f50ca803f5ec4b855ab562dfb4aa2f68cacbdc1a

  • SHA256

    dd9db3ce85e04785fc2e509c534f00ed5e5bf42254a282a641f9c8c1a0a535aa

  • SHA512

    3974e18f26136bd919f2cf0c0b37b3f02c1bc3a78e68c4b0e0a2e141448c5e3e4726b763581b70c8299690ac5bfc2659473267e855ef31d04e587ee35c6fd8b7

  • SSDEEP

    384:e0SvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXB:5S7TZ38fvCv3E1c1rM+rMRa8NudXt

  Score

  8^/10

  evasionpersistence

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2