Overview

overview

10

Static

static

10

be41d7624c...f0.exe

windows7-x64

7

be41d7624c...f0.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.zip

  • Size

    84.9MB

  • Sample

    241103-zphbwatkfx

  • MD5

    90fac7b60f35645f0fa4143232de496a

  • SHA1

    d312439f6594fa4c1b63971c6278b4ede89c8c3d

  • SHA256

    90e77c78704fabb2878871e117d94c3109721d9703b85c0d24c2ea0ae2469996

  • SHA512

    fca47ced73730828115eda3f69d43c931a678e01406b76ddcb07d2618d909533b5e9606da6909021a8c556f7cc0e0c251afbdcb69269588c97a9a36e8643c9a2

  • SSDEEP

    1572864:BOVPHGynU6EUqxggw1LuNnOzqpoXjBFMKtw/f/SzXNzhAUd1Ku8UuWwE0CIefsMR:oeyn8gl6OzNPMJ/3SLNzhAUv8BJM/qy

Score
10/10
blankgrabberdiscoveryevasionexecutionpersistenceupx

Malware Config

Targets

    • Target

      be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe

    • Size

      85.0MB

    • MD5

      a543cc8bf0b67e3a9df1e5c3d762c553

    • SHA1

      37e5f21b3fdc35b26a9d0a6066141060bf4b0402

    • SHA256

      be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0

    • SHA512

      e497a250913efd8c13065df1bbe466bdc7a49e54b440b1999f4e92ccd630641c2d6bcafad39af1222582cde5a61129e2a558e7b741c4be7c535208f4afca8e8e

    • SSDEEP

      1572864:9IC7jQipifYxqmMDnY8TzyZlhH/pAkCN8HTfcUhJq/PEJKtOa:L7j3pSU1/RPl2YKtF

    Score
    9/10
    upxdiscoveryevasionexecutionpersistence

    • Enumerates VirtualBox DLL files

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks