Overview

overview

8

Static

static

3

33925f6fde...bc.exe

windows7-x64

1

33925f6fde...bc.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    33925f6fde07d5f6b71275c2bd3702bc.exe

  • Size

    9.3MB

  • Sample

    240818-qsyzcsycjl

  • MD5

    33925f6fde07d5f6b71275c2bd3702bc

  • SHA1

    a46513127a5afcd74b8d2b3a698d46a31cff1c36

  • SHA256

    c3169aabc913316b0c5826521fd77f22493d9d76546d60fd2445fa204667174b

  • SHA512

    af2a309b0e6f2491a0653836987d5b75c6d8514328c29f510d9d790f2b14e99d3d0d8b4ccc17f9b114d3c4a9eb193bfa85e45e551f5125773aa58a70daabd13f

  • SSDEEP

    196608:D3lIPP8CtyV49A9nE0h7ln0S7wP40gpQVawhO9vH1bzwDIw0KDw2j9wOMcxsj0tg:DaPECtyEyclC

Score
8/10
defense_evasiondiscoveryexecution

Malware Config

Targets

    • Target

      33925f6fde07d5f6b71275c2bd3702bc.exe

    • Size

      9.3MB

    • MD5

      33925f6fde07d5f6b71275c2bd3702bc

    • SHA1

      a46513127a5afcd74b8d2b3a698d46a31cff1c36

    • SHA256

      c3169aabc913316b0c5826521fd77f22493d9d76546d60fd2445fa204667174b

    • SHA512

      af2a309b0e6f2491a0653836987d5b75c6d8514328c29f510d9d790f2b14e99d3d0d8b4ccc17f9b114d3c4a9eb193bfa85e45e551f5125773aa58a70daabd13f

    • SSDEEP

      196608:D3lIPP8CtyV49A9nE0h7ln0S7wP40gpQVawhO9vH1bzwDIw0KDw2j9wOMcxsj0tg:DaPECtyEyclC

    Score
    8/10
    defense_evasiondiscoveryexecution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks