Overview

overview

10

Static

static

10

Retrac.Lau...si.exe

windows10-2004-x64

8

V��E4>�.pyc

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Retrac.Launcher_1.0.14_x64_en-US.msi.exe

  • Size

    8.3MB

  • Sample

    241004-xqe7ss1bkr

  • MD5

    888130aeef27e32f711e4bbe84b8b081

  • SHA1

    abebdc4b529a3624e2e3663cc4fe69345975c5fb

  • SHA256

    c0b2d326b034caf0220f76b183e957d476fb7e9b20b10ce0e4a3ca6898bef45a

  • SHA512

    2463cb8934f399631faf1e2bc2123e9eed49c8f09d15598dd4e778529d436e34c59b5727dc26e74dc43a4df388fb595d6818f8e5f827604872b1ca570d26bcbd

  • SSDEEP

    196608:CPLiurErvI9pWjg/Qc+4o673pNrabebSExEW6UsNMDSHG:++urEUWjZZ4dDLIeWbWrsNbH

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      Retrac.Launcher_1.0.14_x64_en-US.msi.exe

    • Size

      8.3MB

    • MD5

      888130aeef27e32f711e4bbe84b8b081

    • SHA1

      abebdc4b529a3624e2e3663cc4fe69345975c5fb

    • SHA256

      c0b2d326b034caf0220f76b183e957d476fb7e9b20b10ce0e4a3ca6898bef45a

    • SHA512

      2463cb8934f399631faf1e2bc2123e9eed49c8f09d15598dd4e778529d436e34c59b5727dc26e74dc43a4df388fb595d6818f8e5f827604872b1ca570d26bcbd

    • SSDEEP

      196608:CPLiurErvI9pWjg/Qc+4o673pNrabebSExEW6UsNMDSHG:++urEUWjZZ4dDLIeWbWrsNbH

    Score
    8/10
    discoveryexecutionupx

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

    • Target

      V��E4>�.pyc

    • Size

      1KB

    • MD5

      ef532e4d27e12f0bbb4e3f516e9e61d0

    • SHA1

      d0716c0293f7a351f7cc7d4c70959c365e10a600

    • SHA256

      5c2679e1d455ab3ea8cb4ff6fbdc2c8dfbb145369ec5383869188869c24ba280

    • SHA512

      fe8ad206faf6cd990bdbb7409a19cfd22941237e1236b989277544d6c8991b2462dd307f40c6fb1ace2ab076df55b2edb93ba4003ea182980f1d016bcf2da40a

    Score
    1/10
    behavioral2

MITRE ATT&CK Enterprise v15

Tasks