Extracted

• • Target
    081667f0452ad4542fa858796b957f3efe48eb0f63f592b1c5da049f020aada6.exe
  • Size 5.4MB
  • SHA256 081667f0452ad4542fa858796b957f3efe48eb0f63f592b1c5da049f020aada6
  • MD5 6f626a6decafe40565d58c257ec764c1
  • SHA1 7d4cf4e17101ae9c2b92bd6b7c409d6c3cfefe0b
  • SHA512 5c710078f58538222d8a997b9f82361b99a02fd994d907e446298b95961d4be328cf9fd569b81612910f4f059146b6052a986064688d6b5c495cc1a1e1761b42
  • SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMb:9XhICteErownP0oTcMsABqlDQkG
  • TLSH
    T113463308B3A80DE1FAB3D13981665621D473B4254BB0D1CF43AC96662F677E0AF7EB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2