Overview

overview

7

Static

static

5

f276bb4bdc...2N.exe

windows7-x64

7

f276bb4bdc...2N.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    f276bb4bdca026bfbd60a321cbd94aae603bf3b5d4fd20fedb84adc87e920962N

  • Size

    59KB

  • Sample

    241013-lqytcszelf

  • MD5

    64a8bc0d7e623cb8abaf7a9ef8fd9f50

  • SHA1

    93166b69f73806098295402b27cfd055e6554b4d

  • SHA256

    f276bb4bdca026bfbd60a321cbd94aae603bf3b5d4fd20fedb84adc87e920962

  • SHA512

    d88a237aeaa4a11b739233933b444f12c8a7b8c328974d155d064cedacfdc6cc7a7fd1e245d2c30f1bddf9b5dacb6fb0854539e8f0c6fd6aa1c511ea03b8985c

  • SSDEEP

    1536:3+ZgwRdiE8cO4p1xRjfTvSq5r3ZiIZ4nouy8uh1aQM:OeodiUO4p13b9HiIeoutuh1aQM

Score
7/10
defense_evasiondiscoverypersistenceupx

Malware Config

Targets

    • Target

      f276bb4bdca026bfbd60a321cbd94aae603bf3b5d4fd20fedb84adc87e920962N

    • Size

      59KB

    • MD5

      64a8bc0d7e623cb8abaf7a9ef8fd9f50

    • SHA1

      93166b69f73806098295402b27cfd055e6554b4d

    • SHA256

      f276bb4bdca026bfbd60a321cbd94aae603bf3b5d4fd20fedb84adc87e920962

    • SHA512

      d88a237aeaa4a11b739233933b444f12c8a7b8c328974d155d064cedacfdc6cc7a7fd1e245d2c30f1bddf9b5dacb6fb0854539e8f0c6fd6aa1c511ea03b8985c

    • SSDEEP

      1536:3+ZgwRdiE8cO4p1xRjfTvSq5r3ZiIZ4nouy8uh1aQM:OeodiUO4p13b9HiIeoutuh1aQM

    Score
    7/10
    defense_evasiondiscoverypersistenceupx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks