Overview

overview

8

Static

static

ฺฺฺà...ฺฺ

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Escobar Manager.exe

  • Size

    2.1MB

  • Sample

    210223-3cskj1atgs

  • MD5

    6502c0701c4be2957a295f871b87cd9b

  • SHA1

    b1211d62949bd30078d19a86f644b12845384075

  • SHA256

    12206d2f24d20109cf0f5606cf15aa696b62a5c6ae278270624aefc04f103e65

  • SHA512

    f9cf955c905579a8057eedfbe23d4673c116587e944c8db36d232cadbd7868661467a5370e669f93c5edc62b83218ba1b0bf02916395c79b799e737d63777315

Score
8/10
evasionvmprotect

Malware Config

Targets

    • Target

      Escobar Manager.exe

    • Size

      2.1MB

    • MD5

      6502c0701c4be2957a295f871b87cd9b

    • SHA1

      b1211d62949bd30078d19a86f644b12845384075

    • SHA256

      12206d2f24d20109cf0f5606cf15aa696b62a5c6ae278270624aefc04f103e65

    • SHA512

      f9cf955c905579a8057eedfbe23d4673c116587e944c8db36d232cadbd7868661467a5370e669f93c5edc62b83218ba1b0bf02916395c79b799e737d63777315

    Score
    8/10
    evasionvmprotect

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks