Overview

overview

8

Static

static

8

BH.exe

windows7_x64

8

BH.exe

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BH.exe

  • Size

    560KB

  • Sample

    201126-l6p4qnqn9x

  • MD5

    5e1532ecfc1d63bc6f02645b49854db1

  • SHA1

    fa3b3888345c2c653ccc8fc2cf3662f789e78ab4

  • SHA256

    10b5b127d0c994ce5b7977b3f268f43e84dcff56512a0d6947891235d9adb966

  • SHA512

    d660e750b7a6bb0642f215422e9893cd13bc83d549d16cbe8d4fea11a64d517d008a020c59607b569fcfa3782e1b18ddc3da77461a64b9deed1a23727ec97833

Score
8/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      BH.exe

    • Size

      560KB

    • MD5

      5e1532ecfc1d63bc6f02645b49854db1

    • SHA1

      fa3b3888345c2c653ccc8fc2cf3662f789e78ab4

    • SHA256

      10b5b127d0c994ce5b7977b3f268f43e84dcff56512a0d6947891235d9adb966

    • SHA512

      d660e750b7a6bb0642f215422e9893cd13bc83d549d16cbe8d4fea11a64d517d008a020c59607b569fcfa3782e1b18ddc3da77461a64b9deed1a23727ec97833

    Score
    8/10
    evasionpersistence

    • Disables RegEdit via registry modification

      evasion

    • Disables cmd.exe use via registry modification

      evasion

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks