General
- Target CyberLauncher.zip
- Size 6.6MB
- Sample261020-2yctvsys4p
- SHA256 d650676c4d12c0a4e72d4e1025194ed13bce60c33b1db036d85226fe781918bc
Score
10/10
Malware Config
Targets
-
- Target ! SETUP.bat
- Size 3KB
- SHA256 066d5d62e1ed8bcea4de4394ebe4b050fbb705e21e15b15e849c2705eade7f72
Score10/10Windows security bypass
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Cyber.exe
- Size 60KB
- SHA256 664d53faa67e3ba57d947b3bdcdc71e6afb8f2fb25d61c9835f838a77b070788
Score1/10 -
- Target sslconf.exe
- Size 29KB
- SHA256 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
Score10/10Windows security bypass
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of SetThreadContext
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target tempdir.dll
- Size 10.5MB
- SHA256 ddd6e694ebfec6022ee6312ada1aca7d75f33d1d44fa6a788f0cefbf9767b585
Score7/10Executes dropped EXE
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target vcruntime140.dll
- Size 130KB
- SHA256 a5437c6e669b83b5ae336cdddb79fed6425408f3f72ee367441986495e3e56fd
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1