Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    314baffd566dc573f0a93c1aa37be79d444d6ae3106727ab910f74bd142b2b5a.exe
  • Size 5.4MB
  • SHA256 314baffd566dc573f0a93c1aa37be79d444d6ae3106727ab910f74bd142b2b5a
  • MD5 7a94e78ed89c493b2dd291f0faf726dc
  • SHA1 da606ded7ee09d01d0c33d5a5a7b40593c710b98
  • SHA512 ccc1d7838c7bd16325670a75b42597f6f53dc2b64e9cdbd0d04e0a67b5883ead4f51cf87e9a2e082d41e1fc73533189731b24a452bdfee804ba61ce9a816de7d
  • SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6toe:GiiICteErownP0oTcMsABqlAuct/
  • TLSH
    T1FE463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2