e1e2e215389e8f6401db1b693da501bf7d79038d4c6e4bbfa607879eedc489df

General

Target
e1e2e215389e8f6401db1b693da501bf7d79038d4c6e4bbfa607879eedc489df
Size 1.2MB
Sample260710-jsbeqsgx4x
SHA256 e1e2e215389e8f6401db1b693da501bf7d79038d4c6e4bbfa607879eedc489df
MD5 23e60928012dc029213ce1d2824d73c5
SHA1 1b29bf3d5107ba0c42d8eb4f5b6aae0e0d7d15a3
SHA512 3cad6b70b923e924a2c8bc50d97ffd159893e7077775176677bc34a875247b4191d91b700be6255925cc3e6bdbb72df92041a51ffd91dbc74afcfc9076b62122
SSDEEP 24576:t+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHO/jUoBF:t+yZW2IFJ8yRvk8i
TLSH
T12E556C23E18284B1D11462F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  e1e2e215389e8f6401db1b693da501bf7d79038d4c6e4bbfa607879eedc489df
- Size 1.2MB
- SHA256 e1e2e215389e8f6401db1b693da501bf7d79038d4c6e4bbfa607879eedc489df
- MD5 23e60928012dc029213ce1d2824d73c5
- SHA1 1b29bf3d5107ba0c42d8eb4f5b6aae0e0d7d15a3
- SHA512 3cad6b70b923e924a2c8bc50d97ffd159893e7077775176677bc34a875247b4191d91b700be6255925cc3e6bdbb72df92041a51ffd91dbc74afcfc9076b62122
- SSDEEP 24576:t+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHO/jUoBF:t+yZW2IFJ8yRvk8i
- TLSH
  T12E556C23E18284B1D11462F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx
- Adds policy Run key to start application
  persistence
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  .rdata
- Size 180KB
- SHA256 43cc3110c441d88c85988f1ae4bbbbd3b5826156f90d9b2073e0513c248c2e63
- MD5 93321fb8519a222b16b08503a7a05d14
- SHA1 dbd53112a092528e36b337f8b94843969aa84b1e
- SHA512 08cd2a3c8bb1983d5df94fcafcf2d99e10ad3666301309f8d807f12b58431bace760e0ccbe214fa52aad98b9b4313caa7d469decc479ba6b53b5c5d9243586ef
- SSDEEP 3072:mUzxWivRTrwNt7y9iOJNx+UWxTUT0BnXXxprYj/DHxKVWe1nk:+i6v76tgUoBrrYj/DRKX
- TLSH
  T1F5044822B96AC1B3C0969030D6E75395E6A3F8014F224557728C573EFE23264973BBF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4