Overview

overview

10

Static

static

5d7abf9b04...cd.exe

windows7_x64

10

5d7abf9b04...cd.exe

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5d7abf9b0462b7802818c6f35dd3f4126ae27de51367ea8432772325e0a796cd

  • Size

    1.9MB

  • Sample

    210513-fjcdls4ssn

  • MD5

    b64dd47f7c90a33a2168291d61e87343

  • SHA1

    14a144fe079d6c07f6b8274f856afc0f983579b4

  • SHA256

    5d7abf9b0462b7802818c6f35dd3f4126ae27de51367ea8432772325e0a796cd

  • SHA512

    42638a9238a5aca4de4399a89536db0c65de6b8325bcd45dc86eff3d99f6dc9fad52e0e8b7e06cba7136f61de3da781a7559891275e81ac96a590520bc25df19

Score
10/10
vobfuspersistenceworm

Malware Config

Targets

    • Target

      5d7abf9b0462b7802818c6f35dd3f4126ae27de51367ea8432772325e0a796cd

    • Size

      1.9MB

    • MD5

      b64dd47f7c90a33a2168291d61e87343

    • SHA1

      14a144fe079d6c07f6b8274f856afc0f983579b4

    • SHA256

      5d7abf9b0462b7802818c6f35dd3f4126ae27de51367ea8432772325e0a796cd

    • SHA512

      42638a9238a5aca4de4399a89536db0c65de6b8325bcd45dc86eff3d99f6dc9fad52e0e8b7e06cba7136f61de3da781a7559891275e81ac96a590520bc25df19

    Score
    10/10
    vobfuspersistenceworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks