Overview

overview

10

Static

static

10

d1f6950fa8...76.exe

windows7-x64

8

d1f6950fa8...76.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d1f6950fa815d4be5431b4bdbfe240354103e1d73811a7d211748cecf1efa976.exe

  • Size

    8.2MB

  • Sample

    241011-a8sjhs1fmn

  • MD5

    9ae3bffcc517a7082e29e37f5786bd33

  • SHA1

    e8b39fe8e75329a5366bb205216803a67595872d

  • SHA256

    d1f6950fa815d4be5431b4bdbfe240354103e1d73811a7d211748cecf1efa976

  • SHA512

    fae7b69c15dfd12b8c59b8dc2cb85bea6c15af6df0af08cbcbd2f7682a643b126d97e2a016cd220c74a6e38f0343d209dc554771029b38c1d71d16b30eb12baa

  • SSDEEP

    196608:LxtQ008urErvI9pWjgN3ZdahF0pbH1AYSEp6GrUniC+ICz0faxF:durEUWjqeWxQFGrgSzxF

Score
10/10
blankgrabberdiscoveryexecutionobfuscationupx

Malware Config

Targets

    • Target

      d1f6950fa815d4be5431b4bdbfe240354103e1d73811a7d211748cecf1efa976.exe

    • Size

      8.2MB

    • MD5

      9ae3bffcc517a7082e29e37f5786bd33

    • SHA1

      e8b39fe8e75329a5366bb205216803a67595872d

    • SHA256

      d1f6950fa815d4be5431b4bdbfe240354103e1d73811a7d211748cecf1efa976

    • SHA512

      fae7b69c15dfd12b8c59b8dc2cb85bea6c15af6df0af08cbcbd2f7682a643b126d97e2a016cd220c74a6e38f0343d209dc554771029b38c1d71d16b30eb12baa

    • SSDEEP

      196608:LxtQ008urErvI9pWjgN3ZdahF0pbH1AYSEp6GrUniC+ICz0faxF:durEUWjqeWxQFGrgSzxF

    Score
    8/10
    obfuscationupxdiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Obfuscated

      This file is very likely obfuscated.

      obfuscation

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks