General
-
Target
Viber(Compatibility Mode).lnk
-
Size
994B
-
Sample
240428-sv8mpaba9t
-
MD5
ee06100029d5358159a116943017603a
-
SHA1
814e73c3ab473abbb7bdc478e9ef7222daa949eb
-
SHA256
3028bf0c6ae5b359851ca5899945c44262f901320b776b4794850553a8182b6c
-
SHA512
959580d96968510ec5082d7067ba016200c2f792e664b0eb67c552e55fd19a8f4c3ec7e705f33f2c30462c961c67fb36224e20b1b410d131279ad5524f8b62e8
Static task
static1
Malware Config
Targets
-
-
Target
Viber(Compatibility Mode).lnk
-
Size
994B
-
MD5
ee06100029d5358159a116943017603a
-
SHA1
814e73c3ab473abbb7bdc478e9ef7222daa949eb
-
SHA256
3028bf0c6ae5b359851ca5899945c44262f901320b776b4794850553a8182b6c
-
SHA512
959580d96968510ec5082d7067ba016200c2f792e664b0eb67c552e55fd19a8f4c3ec7e705f33f2c30462c961c67fb36224e20b1b410d131279ad5524f8b62e8
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
5Impair Defenses
1Disable or Modify Tools
1Subvert Trust Controls
1Install Root Certificate
1