vobfus | 9436d36f5eb4fb9b4ea2d7e8967012e159f78a3ae2f708d40440a74b300fd146 | Triage

Submit
Reports

Overview

overview

Static

static

5

9436d36f5e...46.exe

windows7-x64

9436d36f5e...46.exe

windows10-2004-x64

Sharing

General

Target

9436d36f5eb4fb9b4ea2d7e8967012e159f78a3ae2f708d40440a74b300fd146.exe
Size

213KB
Sample

241217-n3hc9azkbk
MD5

4f2f3dac026cdfe6a91e3be55d16f8d4
SHA1

dea8c18e4f8a301b68058c1c7da1dd3f972b68c9
SHA256

9436d36f5eb4fb9b4ea2d7e8967012e159f78a3ae2f708d40440a74b300fd146
SHA512

d57e31457b45c0fe58c11db57f7ded3ef2f27b774f7a795fad72097092242db560eb4ce1eaa7ebac1c3cd5bd6014cf80b76be74dd656ea34d6b8839cda063694
SSDEEP

3072:+tnC1KpYs3ggunWFnzBHv/xWFsg8Wat/LFAVWPE5ac0l+nkS71CKbO1hvQ0:34BBHng5HaZFj+nkS71CKbO1Nd

Score

10^/10

vobfus discovery persistence upx worm

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

9436d36f5eb4fb9b4ea2d7e8967012e159f78a3ae2f708d40440a74b300fd146.exe

Resource

win7-20241010-en

vobfus discovery persistence upx worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

9436d36f5eb4fb9b4ea2d7e8967012e159f78a3ae2f708d40440a74b300fd146.exe

Resource

win10v2004-20241007-en

vobfus discovery persistence upx worm

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  9436d36f5eb4fb9b4ea2d7e8967012e159f78a3ae2f708d40440a74b300fd146.exe
- Size
  
  213KB
- MD5
  
  4f2f3dac026cdfe6a91e3be55d16f8d4
- SHA1
  
  dea8c18e4f8a301b68058c1c7da1dd3f972b68c9
- SHA256
  
  9436d36f5eb4fb9b4ea2d7e8967012e159f78a3ae2f708d40440a74b300fd146
- SHA512
  
  d57e31457b45c0fe58c11db57f7ded3ef2f27b774f7a795fad72097092242db560eb4ce1eaa7ebac1c3cd5bd6014cf80b76be74dd656ea34d6b8839cda063694
- SSDEEP
  
  3072:+tnC1KpYs3ggunWFnzBHv/xWFsg8Wat/LFAVWPE5ac0l+nkS71CKbO1hvQ0:34BBHng5HaZFj+nkS71CKbO1Nd
Score

10^/10

vobfus discovery persistence upx worm
- Vobfus
  A widespread worm which spreads via network drives and removable media.
  worm vobfus
- Vobfus family
  vobfus
- Adds policy Run key to start application
  persistence
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vobfusdiscoverypersistenceupxworm

behavioral2

vobfusdiscoverypersistenceupxworm

© 2018-2025

Terms | Privacy