Overview

overview

10

Static

static

10

Built.exe

windows7-x64

7

Built.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Built.exe

  • Size

    7.4MB

  • Sample

    241023-xphljavfjh

  • MD5

    a39f12239ff829f2f04e8af72241b570

  • SHA1

    21473693d2d27b874a97ef92e684d86bd54ebd47

  • SHA256

    4782d5f48e18e82c9aa679dc118697fbbe562a1a155e2bbd43eed2cfbe0dec7e

  • SHA512

    b89b78e80d13fe7c4922498d53a2217d7326671d9c39b20463b4d0994b634e4f72f25787338bd7fa37a18e2b5dacaefd617e151bd13613d34c70c76848d156e7

  • SSDEEP

    196608:THYShEOOshoKMuIkhVastRL5Di3uV1DVC:rYSyOOshouIkPftRL54u3C

Score
10/10
blankgrabberdiscoveryexecutionupx

Malware Config

Targets

    • Target

      Built.exe

    • Size

      7.4MB

    • MD5

      a39f12239ff829f2f04e8af72241b570

    • SHA1

      21473693d2d27b874a97ef92e684d86bd54ebd47

    • SHA256

      4782d5f48e18e82c9aa679dc118697fbbe562a1a155e2bbd43eed2cfbe0dec7e

    • SHA512

      b89b78e80d13fe7c4922498d53a2217d7326671d9c39b20463b4d0994b634e4f72f25787338bd7fa37a18e2b5dacaefd617e151bd13613d34c70c76848d156e7

    • SSDEEP

      196608:THYShEOOshoKMuIkhVastRL5Di3uV1DVC:rYSyOOshouIkPftRL54u3C

    Score
    8/10
    upxdiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks