Extracted

• • Target
    b81b6da48ab1f27541e98be338499bfccd938b3ffe7b2f16cb3120536421d5e8.exe
  • Size 5.4MB
  • SHA256 b81b6da48ab1f27541e98be338499bfccd938b3ffe7b2f16cb3120536421d5e8
  • MD5 5bb5ee0306407c60b5b30339bc824b09
  • SHA1 3fbfcd0e4c9f0df757c48d1558116702dd44a8d4
  • SHA512 6a63ee0e1079b2b9d356f940ae6c7b57ee1d0338b07f5421241a45de734767558ac54617ee706934bdc7544a6c2e085fe736eb4a55289660a5372df0b8c115f0
  • SSDEEP 98304:jHgtHICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllSHmMOQ6tNR:GHICteErownP0oTcMsABql4UtP
  • TLSH
    T1E3463348B3E809E1FAB3E03981565221D572B4264BB0D2CB436C9B662F677D0BF3E754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2