Overview

overview

10

Static

static

8

98fb56a4e9...e4.exe

windows7_x64

8

98fb56a4e9...e4.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98fb56a4e9f490a2e7cad1ed0938f9cb31ad8c1de77c20f2ffced11f842dcce4

  • Size

    220KB

  • Sample

    210515-9wp131awds

  • MD5

    bc4752e1c510ce09d4664472bbc5b0bc

  • SHA1

    6d191cd06cdac7d1e3cb088567ea73a1a042b760

  • SHA256

    98fb56a4e9f490a2e7cad1ed0938f9cb31ad8c1de77c20f2ffced11f842dcce4

  • SHA512

    bd2dc0c17dc6652423baf4afd6eb1afb0853fde139f76729286aa6ce04bae066e787772a72a22ae5688678001b324b002cad2ee21330d528976a0033f0b882c7

Score
10/10
vobfuspersistenceupxworm

Malware Config

Targets

    • Target

      98fb56a4e9f490a2e7cad1ed0938f9cb31ad8c1de77c20f2ffced11f842dcce4

    • Size

      220KB

    • MD5

      bc4752e1c510ce09d4664472bbc5b0bc

    • SHA1

      6d191cd06cdac7d1e3cb088567ea73a1a042b760

    • SHA256

      98fb56a4e9f490a2e7cad1ed0938f9cb31ad8c1de77c20f2ffced11f842dcce4

    • SHA512

      bd2dc0c17dc6652423baf4afd6eb1afb0853fde139f76729286aa6ce04bae066e787772a72a22ae5688678001b324b002cad2ee21330d528976a0033f0b882c7

    Score
    10/10
    persistencevobfusworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks