Overview

overview

8

Static

static

7

645a56cab2...0N.exe

windows7-x64

8

645a56cab2...0N.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    645a56cab20008b072427ab4c05e44a0N.exe

  • Size

    166KB

  • Sample

    240817-rhqqnsserl

  • MD5

    645a56cab20008b072427ab4c05e44a0

  • SHA1

    ee436b249cfa7b3a8c8247f8f4d5731355be5b83

  • SHA256

    c236d2b1c61673115c1bea56ed4d80005ff34beae4cb5dd6fd67554fc2af40bf

  • SHA512

    05a10c4d6014225a2af4616b8fec0343fd67396cf081c28bb338e3aa3bd5dda12c40dd3467709487946e5ccf54fc0a6d76a0a71ffa0d9c87510c64345ba0b85b

  • SSDEEP

    1536:i2WDcOpULCH0a+TNXyyXetH28JZveKivnV:zWDuLzZXyyXeECveDnV

Score
8/10
defense_evasiondiscoveryevasionupx

Malware Config

Targets

    • Target

      645a56cab20008b072427ab4c05e44a0N.exe

    • Size

      166KB

    • MD5

      645a56cab20008b072427ab4c05e44a0

    • SHA1

      ee436b249cfa7b3a8c8247f8f4d5731355be5b83

    • SHA256

      c236d2b1c61673115c1bea56ed4d80005ff34beae4cb5dd6fd67554fc2af40bf

    • SHA512

      05a10c4d6014225a2af4616b8fec0343fd67396cf081c28bb338e3aa3bd5dda12c40dd3467709487946e5ccf54fc0a6d76a0a71ffa0d9c87510c64345ba0b85b

    • SSDEEP

      1536:i2WDcOpULCH0a+TNXyyXetH28JZveKivnV:zWDuLzZXyyXeECveDnV

    Score
    8/10
    defense_evasiondiscoveryevasionupx

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks