11a84779613575152526bc73a0518f972d26c963e772a095558a2107b6b7e7eb

General

Target
test_exe.exe
Size 91.9MB
Sample260630-pegbqaex4r
SHA256 11a84779613575152526bc73a0518f972d26c963e772a095558a2107b6b7e7eb
MD5 65584a5a4e2daedcc7d708492c205867
SHA1 b5938f6be41c3b87ff2a3d3b5beec23cd0da04be
SHA512 99be957a6444275b65dc736aa7c95e3c8aac5f049408a37f374f39aed500984b87dcede8ae3e5e032aa9005e9cd3bc5aac09618927a05e4c3b9ba107b97f8416
SSDEEP 1572864:7ALd+8E42IFoU2YEA96CLafeiMIMreIcdYhm2dUgrMwnZwMY6LcC:7x8EpIFoUxvrmDFafcdYY6wUaMV
TLSH
T16428332A0B8E8152D4AA347F7878534EE196D6E51730C6FF8AB517A308B35CCAF75321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  test_exe.exe
- Size 91.9MB
- SHA256 11a84779613575152526bc73a0518f972d26c963e772a095558a2107b6b7e7eb
- MD5 65584a5a4e2daedcc7d708492c205867
- SHA1 b5938f6be41c3b87ff2a3d3b5beec23cd0da04be
- SHA512 99be957a6444275b65dc736aa7c95e3c8aac5f049408a37f374f39aed500984b87dcede8ae3e5e032aa9005e9cd3bc5aac09618927a05e4c3b9ba107b97f8416
- SSDEEP 1572864:7ALd+8E42IFoU2YEA96CLafeiMIMreIcdYhm2dUgrMwnZwMY6LcC:7x8EpIFoUxvrmDFafcdYY6wUaMV
- TLSH
  T16428332A0B8E8152D4AA347F7878534EE196D6E51730C6FF8AB517A308B35CCAF75321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution upx
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  protections.pyc
- Size 12KB
- SHA256 88d6c1f4c6f3d4d722423a7c9f1069ac345b11362baadabd3c4b7a303f452f6f
- MD5 fa57937acabfcc1ae5c251c0e11e2c9c
- SHA1 c61ca7ce8f6ab74a539b959204ded1fcd11afd88
- SHA512 da0f870ed3d9b2dc78165b61663456abfcd37c4ff8b31994bbb04f6780ead79787ad7a1e687ca898a94202d7a990b70f4dcc5d1a1d7259ee7e95aae226abee98
- SSDEEP 192:tHoTd3sa3N4Q5urc2PLFpuBLUuHdG/k3vaIIvXvU+uvsjyzW3V+9:uJ3sa3u6urpHuBLhHdck3c9kMV+9
- TLSH
  T13A422A7892A0A0E3FCD4ED3435D7388A7373C2959089E653BC74CCD1BE8591F5A6022E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Drops desktop.ini file(s)
behavioral3 behavioral4
- Target
  source_prepared.pyc
- Size 56KB
- SHA256 192136af2a327b174b7e499b4522b1471f552fc8ab59200b19091a33307b7e00
- MD5 249f7f34acc182c61d0e38c939f9764c
- SHA1 f9cf8a9de7e444f620d81eb781885afe408fd7e3
- SHA512 d2f95e59500fe1c35cd3528e1cb8e70a2b54d7af86725d50a84ce5bcb6df4cd76b694b0c75dec449e481877f12318a8037dda725c1806d19074eb9cf615b0592
- SSDEEP 768:LN3dFR+jhl5fzNJYsiJugRH2N12wSoqy0zyUruaGioHwU5YasICZK2s2hN:Lz3+jD5fJJpiJRaSVyJpQOYasIUfdhN
- TLSH
  T1C0434BB89178486BEEC5F03975C2DBE2BB22C090A500C743F5198DF6BFCD6515A86A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

persistence
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

UPX packed file

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6