General
- Target unlicense.7z
- Size 72.6MB
- Sample260730-t7e2ksdj7w
- SHA256 10cefdb57d7ef49a5a538e8e7450f3c5860963ae26ec64e56065ca48d48abfe8
Score
7/10
Malware Config
Targets
-
- Target DDNet.exe
- Size 24.6MB
- SHA256 84d2c4c67979c3d0c139c2dc20fbb547988cb09467f7f74c416d89808d152a90
Score7/10-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
- Target unlicense.exe
- Size 59.5MB
- SHA256 797d305a5f6f3d70de008b20018e60fe82e96910c13d6ba0e1c9a8b389d1d1aa
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1