Resubmissions

29-10-2024 00:27

241029-arxrxaymgp 10

28-10-2024 19:43

241028-yfq2zswbnk 10

General

  • Target

    serverside.xyzexternal.exe

  • Size

    6.0MB

  • Sample

    241028-yfq2zswbnk

  • MD5

    5a991ec34d988f0646119a2f858f28f4

  • SHA1

    53fc617b72823a5b63a69281926eef07b4371912

  • SHA256

    5c7aa4965abe87d06f609e62488e9b53e174dad5582b77932796776cc7d3ba3d

  • SHA512

    2afdacbaa6782ced56f08b905d59145e77147f9b8b54eb6e0ac7806ff7c89c3090efdf68c6c38af6bae484b0cec7a3e4c5b6f6873d85235dda24cfa5a825e0ab

  • SSDEEP

    98304:6MIu4+Dcd0I2iamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HbMX/3H3:6Pp+Dm0IMeNoInY7/sHfbRy9QX0pTk

Malware Config

Targets

    • Target

      serverside.xyzexternal.exe

    • Size

      6.0MB

    • MD5

      5a991ec34d988f0646119a2f858f28f4

    • SHA1

      53fc617b72823a5b63a69281926eef07b4371912

    • SHA256

      5c7aa4965abe87d06f609e62488e9b53e174dad5582b77932796776cc7d3ba3d

    • SHA512

      2afdacbaa6782ced56f08b905d59145e77147f9b8b54eb6e0ac7806ff7c89c3090efdf68c6c38af6bae484b0cec7a3e4c5b6f6873d85235dda24cfa5a825e0ab

    • SSDEEP

      98304:6MIu4+Dcd0I2iamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HbMX/3H3:6Pp+Dm0IMeNoInY7/sHfbRy9QX0pTk

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks