Extracted

• • Target
    f3e6d331ff5a9734f9d7dc480f99c5c5f6d42660815c65fa42db58e01dd812b7.exe
  • Size 5.4MB
  • SHA256 f3e6d331ff5a9734f9d7dc480f99c5c5f6d42660815c65fa42db58e01dd812b7
  • MD5 71a4ec036b60ed27b9e652f4d86995e1
  • SHA1 3705fde98681c205c192ee1f56051509e067e9e9
  • SHA512 35e12410a767c551d0fee66696366eb7d229f8eed7eed5d16372fd8d56218333966e06c1188ed42c3f9a03cafd57b8b5101d20964d05abe5770dd9a61dd5d8e5
  • SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMx:9XhICteErownP0oTcMsABqlDQkC
  • TLSH
    T1B0463308B3A80DE1F9B3D13981665621D473B4254BB0D1CF43AC9A662F677E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2