5339854835f35efbead47f0316f3c5b6c7622d9f8524f3965db9dab856da5710 | Triage

Sharing

General

Target

new.7z
Size

12.7MB
Sample

240825-wccdbaxhmj
MD5

89b5e08a3dec44fe9ee843691776b34f
SHA1

5a357fd4b559600658285b38f2a15bd359aa87f7
SHA256

5339854835f35efbead47f0316f3c5b6c7622d9f8524f3965db9dab856da5710
SHA512

858d0900a4b346c1d3137920dbc55d8aa05ffd40febcbd390d3bcc8ede318ae345703447853073c72ad752c8c68df164340ed2ec5eb30a4450660078d51e16b3
SSDEEP

393216:I9iXQZSoaT59dTs7yitAFc9KJHF8yBzk48WeRu2g:ai4SLT59VsXYc03T4N42g

Score

6^/10

discovery

Malware Config

Targets

- Target
  
  FileApp.exe
- Size
  
  700.0MB
- MD5
  
  043fd5c91f30af1e8ccf540f0ec95012
- SHA1
  
  9b295edf164cd6ecd8015c05318d17f57157b02c
- SHA256
  
  66ec50e4462ada79582360f410b2012da970c50f9ae3754f81bdc58af3a577a5
- SHA512
  
  944caffc5dd65819460c15d5ed655e3c60592b28a9079b4cc1a3ec1238dcb5b5c22babb588d0a1cb125194735fd268732db165fa8c66844dc375b2f52f753516
- SSDEEP
  
  98304:tUr3vGNsbo5GbgCpKQaFJrcvYhs4oaNO2RuU:Or3towXM3FuvYmcO24
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3