3e3a9da980f55f664757acb9653ca82434f1ab46f9bacdd21360f1c7e38649b3

General

Target
3e3a9da980f55f664757acb9653ca82434f1ab46f9bacdd21360f1c7e38649b3
Size 1.2MB
Sample260702-kbmbcaew2x
SHA256 3e3a9da980f55f664757acb9653ca82434f1ab46f9bacdd21360f1c7e38649b3
MD5 6030918811d7310e557f987d6f5fa46d
SHA1 8c2520a5b0276d2b9a758653e73bac001e00bdc6
SHA512 7b1a3adb25888cbe1eb8294265a56db49d51bb43e32d9af044da46e91ed9c62682d93a9d035203368e9a6467581da8213fe732ff83b7ecb98ebe5f3f1466cc4c
SSDEEP 24576:I+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHOqjUoBlD9:I+yZW2IFJ8yRvk8iz
TLSH
T102556C23E18184B1D11862F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  3e3a9da980f55f664757acb9653ca82434f1ab46f9bacdd21360f1c7e38649b3
- Size 1.2MB
- SHA256 3e3a9da980f55f664757acb9653ca82434f1ab46f9bacdd21360f1c7e38649b3
- MD5 6030918811d7310e557f987d6f5fa46d
- SHA1 8c2520a5b0276d2b9a758653e73bac001e00bdc6
- SHA512 7b1a3adb25888cbe1eb8294265a56db49d51bb43e32d9af044da46e91ed9c62682d93a9d035203368e9a6467581da8213fe732ff83b7ecb98ebe5f3f1466cc4c
- SSDEEP 24576:I+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHOqjUoBlD9:I+yZW2IFJ8yRvk8iz
- TLSH
  T102556C23E18184B1D11862F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx adware spyware
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2