Overview

overview

10

Static

static

Allegato_d...60.vbs

windows7_x64

10

Allegato_d...60.vbs

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Allegato_doc_02613440060.vbs

  • Size

    8KB

  • Sample

    210111-63kw6gpz7j

  • MD5

    6266da42dda2a91e97c63181b85b26d4

  • SHA1

    2a0673cc7ea00b5187dac046b906aa1018317236

  • SHA256

    12bad94c43427bae4e3855ebdd60d32d7a6305f108a811ead926950450ec503b

  • SHA512

    fed5ca3e0b5f2214d12c6e8e6d86b6f96589e4629a588bb91cb3df90e3f20c17bb0413f9cbc1683a64642a5b2aa1ddc3ce2a59bb674febe28676c5a5157913c6

Score
10/10
sloadstealertrojan

Malware Config

Targets

    • Target

      Allegato_doc_02613440060.vbs

    • Size

      8KB

    • MD5

      6266da42dda2a91e97c63181b85b26d4

    • SHA1

      2a0673cc7ea00b5187dac046b906aa1018317236

    • SHA256

      12bad94c43427bae4e3855ebdd60d32d7a6305f108a811ead926950450ec503b

    • SHA512

      fed5ca3e0b5f2214d12c6e8e6d86b6f96589e4629a588bb91cb3df90e3f20c17bb0413f9cbc1683a64642a5b2aa1ddc3ce2a59bb674febe28676c5a5157913c6

    Score
    10/10
    sloadstealertrojan

    • sLoad

      sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.

      trojanstealersload

    • Executes dropped EXE

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks