Overview

overview

6

Static

static

1

factura546...38.msi

windows7-x64

6

factura546...38.msi

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    factura546532.msi_factura546532.msi_77938.msi

  • Size

    27.3MB

  • Sample

    240628-s8nvfawblb

  • MD5

    d5853c4d813b09d80738c808e91675e8

  • SHA1

    648867888645fb9c50d2d98ea15f214878e56b46

  • SHA256

    8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393

  • SHA512

    eaed46e72d4fcfad12d10a8d034dfbf0e048792cc0b4aaa317267f9200f06407de8cf83296c520be0603f7b7df0916b597393873d1653922e1e17fcba7f86cc9

  • SSDEEP

    393216:Utwqv0kSEeEqwODp2QLALCKip6SGM4srjbPl5RhpvH3LHZEBFis:Q+x2Sxzn9PHPbZEus

Score
6/10
persistenceprivilege_escalation

Malware Config

Targets

    • Target

      factura546532.msi_factura546532.msi_77938.msi

    • Size

      27.3MB

    • MD5

      d5853c4d813b09d80738c808e91675e8

    • SHA1

      648867888645fb9c50d2d98ea15f214878e56b46

    • SHA256

      8a7559fdc195c6a6bc0ba79ff154c17ca2c8cabbd7f6f5275895caa516448393

    • SHA512

      eaed46e72d4fcfad12d10a8d034dfbf0e048792cc0b4aaa317267f9200f06407de8cf83296c520be0603f7b7df0916b597393873d1653922e1e17fcba7f86cc9

    • SSDEEP

      393216:Utwqv0kSEeEqwODp2QLALCKip6SGM4srjbPl5RhpvH3LHZEBFis:Q+x2Sxzn9PHPbZEus

    Score
    6/10
    persistenceprivilege_escalation

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks