Extracted

• • Target

    CLX.exe

  • Size

    6.1MB

  • MD5

    00dc9b79d26eb73e87c5f9435d7ce838

  • SHA1

    60ce45cebf4dcd17a86173ca0ec2bf9315ce66d7

  • SHA256

    01d803ec4d3146f20365d2527ea307e0d169b0f95323475c1d5280757c570751

  • SHA512

    d7170998cdfaf5b515fb78248e3415ea9d25188ebd57aa74e79427481f4a09739b944a3dc2f4098718f743a31063d8b466ddaa9f3550c8b73832e4bb612db036

  • SSDEEP

    98304:jgqWJCQ6amaHl3Ne4i3gZQSF2x+yAiWMJBYHR/szxcYMZybRorenGHxm98k6ntAz:j+LTeNtx+yAiWfR0FHpdotxs85nBa

  Score

  10^/10

  upxdiscoveryexecution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2

• • Target

    vWf��As.pyc

  • Size

    857B

  • MD5

    d10cbd97933f5b3682bdbae22af4ca82

  • SHA1

    460f15530b2889d385c65a9faab1fb32883e4120

  • SHA256

    ea11ca3f2aaf2b05227d8287eff5bd51abfcf1bc8e478b6c78840ea085956b50

  • SHA512

    3626a3f7ae16f795a9e6e133948c1eb95dbb7811fca7d1bca409d1e3c3a099ccae650948cea28757dae2d7bebc5064e90385100dc9379cdeeae0b1ca62f7bf92

  Score

  1^/10
  behavioral3behavioral4