Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    0230d161266c4786fe5c8b52d17cc16fc615bca8ae0d2bdcc08b06c474781753.exe
  • Size 5.4MB
  • SHA256 0230d161266c4786fe5c8b52d17cc16fc615bca8ae0d2bdcc08b06c474781753
  • MD5 bbf134ea106c1ea2d456c97b3ed07e63
  • SHA1 aaba753fdad7704ed99b9a75269eebc13edc9602
  • SHA512 980002e84f7a8e1e40ffe2f08347dc92e30006ec7196c68b10b75b08b28f19aa6626234488ca41d75d5237e1f8e14a97e87bad647d9c8eceeb84270f35213ee9
  • SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6ur:AsTICteErownP0oTcMsABqljk0
  • TLSH
    T150463308B3E809E1E5B3E13985665221E873B42547B0D5CF43AC9B661F637E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2