5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d | Triage

Sharing

General

Target

5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
Size

274KB
Sample

191025-ncbvrqf7fn
MD5

996ba35165bb62473d2a6743a5200d45
SHA1

52169b0b5cce95c6905873b8d12a759c234bd2e0
SHA256

5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
SHA512

2a7fb9bdf8dcf577ac851752f8875a710a3694b99d107c397942fce1392fd99ee0b85f1fddc18c33fba56d7b8fd4dda5f40f28e64d8398e6048c2ab140780634

Score

7^/10

Malware Config

Targets

- Target
  
  5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
- Size
  
  274KB
- MD5
  
  996ba35165bb62473d2a6743a5200d45
- SHA1
  
  52169b0b5cce95c6905873b8d12a759c234bd2e0
- SHA256
  
  5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
- SHA512
  
  2a7fb9bdf8dcf577ac851752f8875a710a3694b99d107c397942fce1392fd99ee0b85f1fddc18c33fba56d7b8fd4dda5f40f28e64d8398e6048c2ab140780634
Score

7^/10
- Windows security modification
  evasion trojan
- Checks system information in the registry (likely anti-VM)
- Modifies service
  persistence
task1 task2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

task1

task2