Extracted

Extracted

• • Target
    85d8b79d78ac7d17797d3ea7fba9a4be785c417dec9d7c65ee82d3b671203af6.exe
  • Size 5.4MB
  • SHA256 85d8b79d78ac7d17797d3ea7fba9a4be785c417dec9d7c65ee82d3b671203af6
  • MD5 f011e26386d05fe33e00da157f2fd368
  • SHA1 a73881b39ffe99e39cd2e35792398c068a7cb0a9
  • SHA512 bcc9d873f3589aab7c5a64682eaf80afcf6f5b454191d7f77038093676e14c8c621665a1cdf83246d684fd12ee49a628dd8e7081c7f490ef32420fdd4cbd8037
  • SSDEEP 98304:d0gtl6ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolll+HnZMEM66hR:n4ICteErownP0oTcMsABqlTm6X
  • TLSH
    T11D463348B3A809E1FAB3D539856A5221D472B42547B0D1CF03AC9B662F677E0AF3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2