43f1b5da81c82079305ad661e1b2f6b9fe85aa06016c8233a61922ef3f0117ca | Triage

Submit
Reports

Overview

overview

Static

static

43f1b5da81...ca.exe

windows7-x64

9

43f1b5da81...ca.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

Target

43f1b5da81c82079305ad661e1b2f6b9fe85aa06016c8233a61922ef3f0117ca
Size

232KB
Sample

240628-zqmyra1hrd
MD5

b177214f1b272ffaebe6a31be870128a
SHA1

47404a796353b29e2e365da0ad1a6eb8dc74b87f
SHA256

43f1b5da81c82079305ad661e1b2f6b9fe85aa06016c8233a61922ef3f0117ca
SHA512

47a07f2d4f397c82d0176c7cec7630f74f687bddf94be764c0f375514654656ea9565e85f91aa10c7a0bd1bafd24ef9c4a854370aaa2815af8225195f3c24289
SSDEEP

3072:D1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:Ri/NjO5xbg/CSUFLTwMjs6oi/N+O7

Score

10^/10

defense_evasion persistence upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

43f1b5da81c82079305ad661e1b2f6b9fe85aa06016c8233a61922ef3f0117ca.exe

Resource

win7-20240221-en

defense_evasion persistence upx

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

43f1b5da81c82079305ad661e1b2f6b9fe85aa06016c8233a61922ef3f0117ca.exe

Resource

win10v2004-20240611-en

defense_evasion persistence upx

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  43f1b5da81c82079305ad661e1b2f6b9fe85aa06016c8233a61922ef3f0117ca
- Size
  
  232KB
- MD5
  
  b177214f1b272ffaebe6a31be870128a
- SHA1
  
  47404a796353b29e2e365da0ad1a6eb8dc74b87f
- SHA256
  
  43f1b5da81c82079305ad661e1b2f6b9fe85aa06016c8233a61922ef3f0117ca
- SHA512
  
  47a07f2d4f397c82d0176c7cec7630f74f687bddf94be764c0f375514654656ea9565e85f91aa10c7a0bd1bafd24ef9c4a854370aaa2815af8225195f3c24289
- SSDEEP
  
  3072:D1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:Ri/NjO5xbg/CSUFLTwMjs6oi/N+O7
Score

9^/10

defense_evasion persistence upx
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionpersistenceupx

behavioral2

defense_evasionpersistenceupx

© 2018-2025

Terms | Privacy