Extracted

Extracted

• • Target
    58a57e4666aef5c28602fdad37be4418209e9b7e5f4f89baf756112ed841687e.exe
  • Size 5.4MB
  • SHA256 58a57e4666aef5c28602fdad37be4418209e9b7e5f4f89baf756112ed841687e
  • MD5 7088fc0c6c34e7a6fb3980144d4b904e
  • SHA1 cc1e605817e0850ce9ce3841b3f7f9032b518546
  • SHA512 fdf39f6f39ed4d3669f18afaf25e351d4580625fdfe5dd06129ed14a842e100c2064afea387b20a6d3ccf5f7f9090a75e19033578b0005f1ae08e10566acb4f4
  • SSDEEP 98304:d0gtl6ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolll+HnZMEM66h4:n4ICteErownP0oTcMsABqlTm6i
  • TLSH
    T10B463348B3E809E1FAB3D539856A5221D472B52547B0D1CF03AC9B662F677E0AE3F710
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2