Overview

overview

10

Static

static

good.exe

windows7_x64

10

good.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    good.exe

  • Size

    117KB

  • Sample

    201109-rlvgs7ywzn

  • MD5

    3656d2dfcd4f9ebf97e03fa2c9a05ade

  • SHA1

    bd9ecbe901ff4366c789fa63eaffdda9d3f4e931

  • SHA256

    b479533a51ba629bd5f20a7e9faa3bcccfddc72218b23dfd5a4ab15825204944

  • SHA512

    2eb3f78eb1e6dd34563c78a5bd656813a4e80f49676a9fec5ab33290b9fa487d8817ff5cf8c3241031fadf0a010c8a0bf3c9afa5dda9e5c519838a3089350738

Score
10/10
ostapdownloaderpersistence

Malware Config

Targets

    • Target

      good.exe

    • Size

      117KB

    • MD5

      3656d2dfcd4f9ebf97e03fa2c9a05ade

    • SHA1

      bd9ecbe901ff4366c789fa63eaffdda9d3f4e931

    • SHA256

      b479533a51ba629bd5f20a7e9faa3bcccfddc72218b23dfd5a4ab15825204944

    • SHA512

      2eb3f78eb1e6dd34563c78a5bd656813a4e80f49676a9fec5ab33290b9fa487d8817ff5cf8c3241031fadf0a010c8a0bf3c9afa5dda9e5c519838a3089350738

    Score
    10/10
    ostapdownloaderpersistence

    • Ostap JavaScript Downloader

      Ostap is a JavaScript downloader that's been active since 2016. It's used to deliver several families, inluding TrickBot

    • ostap

      Ostap is a JS downloader, used to deliver other families.

      downloaderostap

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks