Overview

overview

10

Static

static

8

aac389699b...fc.exe

windows7_x64

10

aac389699b...fc.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aac389699b23ed3e257fc4f015bbe845fcdffc15e4ed3f556b7761a28969b4fc

  • Size

    221KB

  • Sample

    210515-1hwsjdrwvx

  • MD5

    b43417d1d2ecf21e153fb25c17b7782a

  • SHA1

    335c63dbedaa19d6a53aef11a8710ff25f7ad982

  • SHA256

    aac389699b23ed3e257fc4f015bbe845fcdffc15e4ed3f556b7761a28969b4fc

  • SHA512

    0c1deb022681f302aead6d06d68b092ce05db77e7807528a3047fed92d238e8dd0cecddb9e183d1b09c1da9fdc91b9958f62ec7fdb6f6076f0b8bba0464d1709

Score
10/10
vobfuspersistenceupxworm

Malware Config

Targets

    • Target

      aac389699b23ed3e257fc4f015bbe845fcdffc15e4ed3f556b7761a28969b4fc

    • Size

      221KB

    • MD5

      b43417d1d2ecf21e153fb25c17b7782a

    • SHA1

      335c63dbedaa19d6a53aef11a8710ff25f7ad982

    • SHA256

      aac389699b23ed3e257fc4f015bbe845fcdffc15e4ed3f556b7761a28969b4fc

    • SHA512

      0c1deb022681f302aead6d06d68b092ce05db77e7807528a3047fed92d238e8dd0cecddb9e183d1b09c1da9fdc91b9958f62ec7fdb6f6076f0b8bba0464d1709

    Score
    10/10
    vobfuspersistenceworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks