General
-
Target
HiSpigItsChaosImJustDoingThisToShowThatRatsGetAutoNukedOnTriage.exe
-
Size
6.7MB
-
Sample
241026-x32lkawlgx
-
MD5
e56e84716421003417dfff63cb4958f1
-
SHA1
5b34c05dc8474b7dd349b537fa32820bce9a6b3b
-
SHA256
dcd01ef17cf8041120888fa94db1b052a5e24e5e10f04f13a491898eeaaa1455
-
SHA512
ad354c1356cbc95d1f6e491677515cc7c1280ee56e9254a3fae05a7623d1cad6a3d6fb53c67210c50ae493c1ec072e412f561aeca7dc4f6045adbb752c9e608e
-
SSDEEP
196608:YiFhm/AeN/FJMIDJf0gsAGK5SEQRfnAK7dCG:lw/Fqyf0gsfNfAKX
Malware Config
Targets
-
-
Target
HiSpigItsChaosImJustDoingThisToShowThatRatsGetAutoNukedOnTriage.exe
-
Size
6.7MB
-
MD5
e56e84716421003417dfff63cb4958f1
-
SHA1
5b34c05dc8474b7dd349b537fa32820bce9a6b3b
-
SHA256
dcd01ef17cf8041120888fa94db1b052a5e24e5e10f04f13a491898eeaaa1455
-
SHA512
ad354c1356cbc95d1f6e491677515cc7c1280ee56e9254a3fae05a7623d1cad6a3d6fb53c67210c50ae493c1ec072e412f561aeca7dc4f6045adbb752c9e608e
-
SSDEEP
196608:YiFhm/AeN/FJMIDJf0gsAGK5SEQRfnAK7dCG:lw/Fqyf0gsfNfAKX
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-