Extracted

• • Target
    ece24a9619cbf4209093f3e6219b1ba9ca165ed176f171fd05b46fa0a6d91c69
  • Size 20KB
  • SHA256 ece24a9619cbf4209093f3e6219b1ba9ca165ed176f171fd05b46fa0a6d91c69
  • MD5 f8310bd8ac8ec6361bbf42f6bd525110
  • SHA1 22997c72682c2cbe62cfd2dbf90868525e494968
  • SHA512 98363e0ab5321417c0c6995adccf1ee8bd60957052cd4793fc498651556c51ab1f7389a6caa2c75376028a2acd0fc7a9e2e4ef692634f97fbfa072f124428fc4
  • SSDEEP 384:U2hKY1IeMbDvzKIthWjrKpfOlxTxIhl4m/lJ2omLbQGwSaRAhBzeGeBbs:Z/1SDmIth0OpmxVI/4mj2omLb2SayG
  • TLSH
    T17192D09FC3B8DF7AC08AA37E6C4BCE0CBD0E6E19967A46F55566779728B63100058F10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryservstartupx

  • Detects ServStart payload

  • ServStart

    ServStart is a backdoor written in C.

    backdoorservstart

  • Servstart family

    servstart

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2