Overview

overview

8

Static

static

DualShot.bin.exe

windows7_x64

DualShot.bin.exe

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DualShot.bin.zip

  • Size

    8KB

  • Sample

    200607-gdq88mtksj

  • MD5

    31a1bec547e39b09eefd853816d2e145

  • SHA1

    a6010bdd3182b86e80a831f0ee1b42e7520792bd

  • SHA256

    903e81e3fdb527a15f694ca5a9b38b541b60491e53ee01fa30b9721dbb38cb35

  • SHA512

    0001169160a053a99414a49571b90ce2407cb56f024f38e049be0df09b4302b0099a025315b7775f05c0a1a02143ca8aee6f722bd6b8a79dc41bd76be5aa63d6

Score
8/10
bootkitpersistenceransomware

Malware Config

Targets

    • Target

      DualShot.bin

    • Size

      18KB

    • MD5

      15c9143498141f0e29c2cc411c011649

    • SHA1

      1b511413cd5a3e18b56684c4c68723125b749e95

    • SHA256

      fed9e1bfcbd37a9f6df28c65adbb07ecc9745ed96a03ddaf3716d4324730b3df

    • SHA512

      562677945e922043bfaaa08b66229d4467428364db08c7eedd8f5817171e74d561e2d736e21bea2382dad9ec3a40b51973f51ed09285a35b2fd2d21f5dd995a5

    Score
    8/10
    persistenceransomwarebootkit

    • Executes dropped EXE

    • Modifies WinLogon to allow AutoLogon

      Enables rebooting of the machine without requiring login credentials.

      ransomwarebootkit

    • Adds Run entry to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks