Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    e98887dfa3bda66200127e4c433e7af1087c23fb13f3a05b949d74051c8575ea.exe
  • Size 5.4MB
  • SHA256 e98887dfa3bda66200127e4c433e7af1087c23fb13f3a05b949d74051c8575ea
  • MD5 f12fa2150c274192ec33f5649d591fb2
  • SHA1 43866a1ed49905b040754c575bb2ecf6ba19c787
  • SHA512 c8d81a9a0c68ca7b5bc3fa6e2c13c7ff350e5263c5f06563c58d1de4ee5c9195662ec3995c026866043cf1ff1fabc5572c131e98258bf40572d796aa652bbf74
  • SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1l:Hdx2ICteErownP0oTcMsABqlqBn7
  • TLSH
    T18A463308B3E809E1E9B3D13D85665221D473B4254BB0D5CF03AC9B662F777E0AE3AB54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2