Overview

overview

8

task1

 

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a199c533508763d9142d7d041847e391e3eac17239c23e0889e7b815243143a

  • Size

    166KB

  • Sample

    191212-67ms4vr26j

  • MD5

    6f8ec42cebc553c2b1c65f8cc070de7f

  • SHA1

    5fed6f0125b1e60986726e76c1219c64ee5abfb0

  • SHA256

    6a199c533508763d9142d7d041847e391e3eac17239c23e0889e7b815243143a

  • SHA512

    baf665f4dff9b0953084cabc4b19404329b753077b4f623da6748896ef66dad6682620b2010935165dd4288507423847bec34e8312a472f71fb1b8ea7495a01f

Score
8/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://acqua.solarcytec.com/rtsbgs/XiWmtYYur/
exe.dropper

https://blog.learncy.net/wp-admin/user/oxZqQp/
exe.dropper

http://hospitalsanrafael.ainimedina.com/wp-includes/vwf-i8ge-4445917/
exe.dropper

https://sg771.kwikfunnels.com/phpmyadmin_bck/x9tfn-lv1h4-174129596/
exe.dropper

http://www.siyinjichangjia.com/wp-content/WYszsP/

Targets

    • Target

      6a199c533508763d9142d7d041847e391e3eac17239c23e0889e7b815243143a

    • Size

      166KB

    • MD5

      6f8ec42cebc553c2b1c65f8cc070de7f

    • SHA1

      5fed6f0125b1e60986726e76c1219c64ee5abfb0

    • SHA256

      6a199c533508763d9142d7d041847e391e3eac17239c23e0889e7b815243143a

    • SHA512

      baf665f4dff9b0953084cabc4b19404329b753077b4f623da6748896ef66dad6682620b2010935165dd4288507423847bec34e8312a472f71fb1b8ea7495a01f

    Score
    8/10

    • Executes dropped EXE

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    task1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks