Overview

overview

6

Static

static

3

f0aafbf531...37.exe

windows7-x64

6

f0aafbf531...37.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0aafbf531e08a0d1370d74e1a908a465613f27017a48dd6110424028c1bb737.exe

  • Size

    24.9MB

  • Sample

    240726-hm64saselp

  • MD5

    7746635b26b9399419bd5542b2770dbc

  • SHA1

    05e5b7a753a081e3a929af934901896fbf55ec4c

  • SHA256

    f0aafbf531e08a0d1370d74e1a908a465613f27017a48dd6110424028c1bb737

  • SHA512

    e7a340372721c836e70b00274e2e25312adb97f6c014c6d49da92cd41dbc91e5b374a45b4e7e9def68ecab860504cd2e0b8ca5ab7d2ed0cdc01249204d795a61

  • SSDEEP

    786432:2Dchya9CQ+pjF28WRdEWoSBOLBj3epdgx:achZ2jFradElLw

Score
6/10
discoverypersistence

Malware Config

Targets

    • Target

      f0aafbf531e08a0d1370d74e1a908a465613f27017a48dd6110424028c1bb737.exe

    • Size

      24.9MB

    • MD5

      7746635b26b9399419bd5542b2770dbc

    • SHA1

      05e5b7a753a081e3a929af934901896fbf55ec4c

    • SHA256

      f0aafbf531e08a0d1370d74e1a908a465613f27017a48dd6110424028c1bb737

    • SHA512

      e7a340372721c836e70b00274e2e25312adb97f6c014c6d49da92cd41dbc91e5b374a45b4e7e9def68ecab860504cd2e0b8ca5ab7d2ed0cdc01249204d795a61

    • SSDEEP

      786432:2Dchya9CQ+pjF28WRdEWoSBOLBj3epdgx:achZ2jFradElLw

    Score
    6/10
    discoverypersistence

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks