Overview

overview

10

Static

static

1fa7eff565...31.exe

windows7_x64

10

1fa7eff565...31.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1fa7eff565de08c87b5eabffc8cc2890a3d9ecb4c293cc95c2818ebbc31b3931

  • Size

    318KB

  • Sample

    210515-alvam534w6

  • MD5

    b6bc25ddeede6b0282c95a36ecc7c2a6

  • SHA1

    6995af4d5e021c774c05c0594fd9dab3679efd5b

  • SHA256

    1fa7eff565de08c87b5eabffc8cc2890a3d9ecb4c293cc95c2818ebbc31b3931

  • SHA512

    36bcc2e15e6e8bff6e41d694e7dc35774260c32621c07e2d06b475ccc6c0f77e9aac65115a088e5edd6d64a8198aaaf2d97c71b4082e212b14f4918d43b80ab2

Score
10/10
vobfuspersistenceworm

Malware Config

Targets

    • Target

      1fa7eff565de08c87b5eabffc8cc2890a3d9ecb4c293cc95c2818ebbc31b3931

    • Size

      318KB

    • MD5

      b6bc25ddeede6b0282c95a36ecc7c2a6

    • SHA1

      6995af4d5e021c774c05c0594fd9dab3679efd5b

    • SHA256

      1fa7eff565de08c87b5eabffc8cc2890a3d9ecb4c293cc95c2818ebbc31b3931

    • SHA512

      36bcc2e15e6e8bff6e41d694e7dc35774260c32621c07e2d06b475ccc6c0f77e9aac65115a088e5edd6d64a8198aaaf2d97c71b4082e212b14f4918d43b80ab2

    Score
    10/10
    vobfuspersistenceworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks