General
- Target beetle-cab.cab
- Size 13.1MB
- Sample260804-pfhk6swvbw
- SHA256 bf0a5efb3d84fa52938ccf45d84483386606204b4f6473cb9030b53baf7b1ba4
Score
8/10
Malware Config
Targets
-
- Target beetle-cab/7za.dll
- Size 272KB
- SHA256 d7f1224cc4afb90af3792dadfdf2f14bad4a19329ee0f3c87c111611aa36b7b1
Score3/10 -
- Target beetle-cab/7za.exe
- Size 796KB
- SHA256 ba7f3627715614d113c1e1cd7dd9d47e3402a1e8a7404043e08bc14939364549
Score3/10 -
- Target beetle-cab/7zxa.dll
- Size 161KB
- SHA256 6b4888207c46c23d2d4e4eace8a2db01711692bc7d4bb93f3750bc41e91bb73c
Score3/10 -
- Target beetle-cab/start.cmd
- Size 86B
- SHA256 030ee398e53caf0928e757162f3c7be7d593a59dde2795991ec7e4fd8e71f2e3
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1