Overview

overview

10

Static

static

3

forcedelctl.dll

windows7-x64

10

forcedelctl.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    forcedelctl.dll

  • Size

    956KB

  • Sample

    240619-wx32rszhpm

  • MD5

    b28a478eb5b99efcdc7caf428bffb89a

  • SHA1

    d394c7b8fe15753bfbff79fb4f648f6f8bae70f9

  • SHA256

    3bca1dcaef4430272b9029c9a4bc8be0d45ecff66e8de8679ed30d8afab00f6f

  • SHA512

    decb2581f64949bfaaaf0368917f0705d7a4b7392ec272eda025cf06a4384ec4cdd5202081c2e085f00645029dd96bfef262e8628bed1861185adf6281c1cc88

  • SSDEEP

    24576:rs6ZRS5J3ifJvlxfcdaeti7w+0bf0XznPMvPD:Yni8dK9CEMXD

Score
10/10
ssloadloader

Malware Config

Targets

    • Target

      forcedelctl.dll

    • Size

      956KB

    • MD5

      b28a478eb5b99efcdc7caf428bffb89a

    • SHA1

      d394c7b8fe15753bfbff79fb4f648f6f8bae70f9

    • SHA256

      3bca1dcaef4430272b9029c9a4bc8be0d45ecff66e8de8679ed30d8afab00f6f

    • SHA512

      decb2581f64949bfaaaf0368917f0705d7a4b7392ec272eda025cf06a4384ec4cdd5202081c2e085f00645029dd96bfef262e8628bed1861185adf6281c1cc88

    • SSDEEP

      24576:rs6ZRS5J3ifJvlxfcdaeti7w+0bf0XznPMvPD:Yni8dK9CEMXD

    Score
    10/10
    ssloadloader

    • SSLoad

      SSLoad Unpacked DLL payload.

      loaderssload

    • Detects SSLoad Unpacked payload

      loader

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks