Overview

overview

10

Static

static

3

NFgODbNY.exe

windows7_x64

10

NFgODbNY.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NFgODbNY.exe

  • Size

    6.6MB

  • Sample

    210505-h5wxdl1ltn

  • MD5

    5f6a74e286c98bbe45a6a667026813bc

  • SHA1

    5d17945ebbb46e1f73ce15a8a110e0e1b6c165da

  • SHA256

    863853bdbdb6ed3d644305d866286c1fa25255e62851f3d7bee5f3e2bcefaa98

  • SHA512

    0f1f2e000dc7f0f7fff435fba887c19a9698e7004bea64baddafd17d96e4bbe1266f6ce9a27296d220ef7a6b17fab65e787e01e6a1e2aff4ea0fa1d58f84a701

Score
10/10
beapyevasionminerpyinstallerworm

Malware Config

Targets

    • Target

      NFgODbNY.exe

    • Size

      6.6MB

    • MD5

      5f6a74e286c98bbe45a6a667026813bc

    • SHA1

      5d17945ebbb46e1f73ce15a8a110e0e1b6c165da

    • SHA256

      863853bdbdb6ed3d644305d866286c1fa25255e62851f3d7bee5f3e2bcefaa98

    • SHA512

      0f1f2e000dc7f0f7fff435fba887c19a9698e7004bea64baddafd17d96e4bbe1266f6ce9a27296d220ef7a6b17fab65e787e01e6a1e2aff4ea0fa1d58f84a701

    Score
    10/10
    beapyevasionminerworm

    • Beapy

      Beapy is a python worm with crypto mining capabilities.

      minerwormbeapy

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Command-Line Interface

1
T1059

Persistence

Account Manipulation

1
T1098

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks