Overview

overview

10

Static

static

8

ed1dc39734...cf.exe

windows7_x64

10

ed1dc39734...cf.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed1dc397346720488c73104eee8dbfa73fc29298f9241c3f4608bf9ddcf5dbcf

  • Size

    384KB

  • Sample

    210513-ddsns215ca

  • MD5

    ba28a2ddf41450c0e30a80eba7a84001

  • SHA1

    8dba49ba4ad881a1a0c4f81839dce52285dd647b

  • SHA256

    ed1dc397346720488c73104eee8dbfa73fc29298f9241c3f4608bf9ddcf5dbcf

  • SHA512

    2536377a5a9cf839ec2aac08ac45ed44d8accccf9a1f64f71cee3a3454de1bf81190140ae55d0ad729a026f1d35629724cbaea36c787e7fd394c5230ba71c913

Score
10/10
vobfuspersistenceupxworm

Malware Config

Targets

    • Target

      ed1dc397346720488c73104eee8dbfa73fc29298f9241c3f4608bf9ddcf5dbcf

    • Size

      384KB

    • MD5

      ba28a2ddf41450c0e30a80eba7a84001

    • SHA1

      8dba49ba4ad881a1a0c4f81839dce52285dd647b

    • SHA256

      ed1dc397346720488c73104eee8dbfa73fc29298f9241c3f4608bf9ddcf5dbcf

    • SHA512

      2536377a5a9cf839ec2aac08ac45ed44d8accccf9a1f64f71cee3a3454de1bf81190140ae55d0ad729a026f1d35629724cbaea36c787e7fd394c5230ba71c913

    Score
    10/10
    vobfuspersistenceworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks