Overview

overview

10

Static

static

SecuriteIn...55.exe

windows7_x64

10

SecuriteIn...55.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555
  • Size 63KB
  • Sample201205-vc86f9s8ke
  • SHA256 d6964f92949edac5e3f2b740a6c2fa121eb1539f5a291ee7d4cc5cd55cadd49d
  • MD5 SHA1 SHA512
Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target
      SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555
    • Size 63KB
    • SHA256 d6964f92949edac5e3f2b740a6c2fa121eb1539f5a291ee7d4cc5cd55cadd49d
    • MD5 SHA1 SHA512
    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • Drops startup file

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks