Overview

overview

10

Static

static

readme.js

windows7_x64

10

readme.js

windows10_x64

10

Resubmissions

13-01-2021 06:51

210113-rkhah56hvs 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    readme.js

  • Size

    9KB

  • Sample

    210113-rkhah56hvs

  • MD5

    8a047f4917d75bb0bb6659e41569a9b7

  • SHA1

    388ac00a76db82a0ac2434d1b4fb7420bab1a403

  • SHA256

    f517526fc57eb33edb832920b1678d52ad1c5cf9c707859551fe065727587501

  • SHA512

    0caf75d7adf94e624a6abe947e75e0d80a58fef8e331ee88a65fd24ee1f28e773295defa2cdac01e52ee7ebc8c3a0d2e8bb0676871bccab2fe1ea739b9de41c9

Score
10/10
evasion

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://t.zz3r0.com

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://t.zer9g.com

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://t.bb3u9.com

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://t.bb3u9.com

Targets

    • Target

      readme.js

    • Size

      9KB

    • MD5

      8a047f4917d75bb0bb6659e41569a9b7

    • SHA1

      388ac00a76db82a0ac2434d1b4fb7420bab1a403

    • SHA256

      f517526fc57eb33edb832920b1678d52ad1c5cf9c707859551fe065727587501

    • SHA512

      0caf75d7adf94e624a6abe947e75e0d80a58fef8e331ee88a65fd24ee1f28e773295defa2cdac01e52ee7ebc8c3a0d2e8bb0676871bccab2fe1ea739b9de41c9

    Score
    10/10
    evasion

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks