Overview

overview

10

Static

static

10

Built.exe

windows7-x64

7

Built.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Built.exe

  • Size

    6.0MB

  • Sample

    241028-vldr3asjek

  • MD5

    372a3bfc16d8e6f896b82d559c5d2b27

  • SHA1

    333891546f4540440513d4834881ecd26aa5d06e

  • SHA256

    f5174d10874ffa10d34d866f11e76142881d7c54dcdf54005a48bb95ee2fb00b

  • SHA512

    b0b20f6ac45f268b5a5fc63f09a43e7daae8cab91410ebf1935fa43a7c20b4865cefd19dde69029e31a4f1c4b76a24f4870cfbca16d838cc0c40d6d193f250b8

  • SSDEEP

    98304:9rEtdFBCIB82oamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RKOLPeMruyM:9CFIIJJeN/FJMIDJf0gsAGK4RRLPeC1M

Score
10/10
blankgrabberexecutionupx

Malware Config

Targets

    • Target

      Built.exe

    • Size

      6.0MB

    • MD5

      372a3bfc16d8e6f896b82d559c5d2b27

    • SHA1

      333891546f4540440513d4834881ecd26aa5d06e

    • SHA256

      f5174d10874ffa10d34d866f11e76142881d7c54dcdf54005a48bb95ee2fb00b

    • SHA512

      b0b20f6ac45f268b5a5fc63f09a43e7daae8cab91410ebf1935fa43a7c20b4865cefd19dde69029e31a4f1c4b76a24f4870cfbca16d838cc0c40d6d193f250b8

    • SSDEEP

      98304:9rEtdFBCIB82oamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RKOLPeMruyM:9CFIIJJeN/FJMIDJf0gsAGK4RRLPeC1M

    Score
    8/10
    upxexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks