Extracted

• • Target
    ad5546c8c866d61852efc35b13aade2844266e8875f4e71e03e3af0895764283.exe
  • Size 5.4MB
  • SHA256 ad5546c8c866d61852efc35b13aade2844266e8875f4e71e03e3af0895764283
  • MD5 cf6c22c2ebeb310fcd22c651c3b88cc4
  • SHA1 8cc104135973b9bd644ee15eb016d66bd8034ae9
  • SHA512 d646d8a932f62a0339c76cce66579ad7f6f248ab651adb1fcd6f30a0723e505dc0366cf93ad9d2b405b0583d5d1648d77a9cee474768e78b22661d4f2b4f8c7f
  • SSDEEP 98304:d0gtl6ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolll+HnZMEM66hN:n4ICteErownP0oTcMsABqlTm6r
  • TLSH
    T191463348B3E809E1FAB3D539856A5221D472B42547B0D1CF03AC9B662F677E0AE3F750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2