Overview

overview

10

Static

static

10

UserAgent.exe

windows7-x64

7

UserAgent.exe

windows10-2004-x64

8

Resubmissions

20-10-2024 14:17

241020-rlvtsssejh 10

19-10-2024 23:47

241019-3ste4aybrk 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UserAgent.exe

  • Size

    7.6MB

  • Sample

    241019-3ste4aybrk

  • MD5

    e9d8976b1b06d9f3298a9a39e5baf749

  • SHA1

    1fad970d19a9a172efacdaa907ddd236f2b9e7fb

  • SHA256

    c3e8ec04af109edcce133adeea88123775012a56a0bcd10fbb8b933b7560ce32

  • SHA512

    380e0d3cd231a2f9113945ae5cf4684b9c9847d8b111dbdc1fb134f357c971102add60ed716d1f5b8e477e62a3b0fa64593a3bb084713768dbace7c3aec89660

  • SSDEEP

    196608:EFCHYNGwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/j4:+PtIHziK1piXLGVE4Ue0VJ8

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      UserAgent.exe

    • Size

      7.6MB

    • MD5

      e9d8976b1b06d9f3298a9a39e5baf749

    • SHA1

      1fad970d19a9a172efacdaa907ddd236f2b9e7fb

    • SHA256

      c3e8ec04af109edcce133adeea88123775012a56a0bcd10fbb8b933b7560ce32

    • SHA512

      380e0d3cd231a2f9113945ae5cf4684b9c9847d8b111dbdc1fb134f357c971102add60ed716d1f5b8e477e62a3b0fa64593a3bb084713768dbace7c3aec89660

    • SSDEEP

      196608:EFCHYNGwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/j4:+PtIHziK1piXLGVE4Ue0VJ8

    Score
    8/10
    upxdiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks