Extracted

• • Target

    bb128ec75526887e8ebc2c1e4c0daf7b7ec1d41f039c0fb88e927b90fce6df9e.exe

  • Size

    93KB

  • MD5

    02cefbda3396f784034e71616e52d67e

  • SHA1

    b38666d28beb902565260bf87d4f367911e94eda

  • SHA256

    bb128ec75526887e8ebc2c1e4c0daf7b7ec1d41f039c0fb88e927b90fce6df9e

  • SHA512

    4c17201e33a1c9fc6ff5cb476fe548447cdeeea20f494ea1a77bde704d97de7826b6ec880274fed2071d29499f3df09a8737770557f27d7d3134e16a8e80b92a

  • SSDEEP

    1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Drops startup file

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2