df638bde1ffafcfb7a25fe30b631d549299f9502f23efc47fc5efaa118e96b97

Resubmissions

25/09/2025, 14:20

250925-rnewcszth110

25/06/2020, 12:12

200625-zes52c3c9210

Sharing

Copy URL Twitter E-mail

General

Target
oreon.bin
Size 83KB
Sample200625-zes52c3c92
SHA256 df638bde1ffafcfb7a25fe30b631d549299f9502f23efc47fc5efaa118e96b97
MD5 9b578f0928e4e4a2761e4cbf85555817
SHA1 9e5e685f23e66c4c3024d201f44c86c1c1ba107e
SHA512 8332157583919d94e94d101d2b9c4693ce6a89c6c49d55e986c550b4f63fa894f8b1e53421f0305690bf401dc42985d515c9e30c216ae36e696bca950a1990c3
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Targets

- Target
  oreon.bin
- Size 83KB
- SHA256 df638bde1ffafcfb7a25fe30b631d549299f9502f23efc47fc5efaa118e96b97
- MD5 9b578f0928e4e4a2761e4cbf85555817
- SHA1 9e5e685f23e66c4c3024d201f44c86c1c1ba107e
- SHA512 8332157583919d94e94d101d2b9c4693ce6a89c6c49d55e986c550b4f63fa894f8b1e53421f0305690bf401dc42985d515c9e30c216ae36e696bca950a1990c3
- MD5 SHA1 SHA512
Score

10^/10

persistence
- Modifies WinLogon for persistence
  persistence
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Enumerates connected drives
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Modifies WinLogon for persistence

Executes dropped EXE

Deletes itself

Loads dropped DLL

Enumerates connected drives

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2