Overview

overview

10

Static

static

426b1f446f...2b.exe

windows7_x64

10

426b1f446f...2b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    426b1f446f677435e50b196ad62c3013949359837a4d8cac38657a7f7e4fc92b

  • Size

    571KB

  • Sample

    210516-lar7a4w82x

  • MD5

    cef81112287a623ee228f3a803f253c6

  • SHA1

    3f63d838832876589704ba5e9fabdcc8b2f96e88

  • SHA256

    426b1f446f677435e50b196ad62c3013949359837a4d8cac38657a7f7e4fc92b

  • SHA512

    d51d1ad8daf6ebf3f5b825b47f43c6e8a3babca92457c4567ecdc054fa1528cc68dbdcfe4592f15085d682b1d5a984004fa5c2100d65437bf16328733afba122

Score
10/10
vobfuspersistenceworm

Malware Config

Targets

    • Target

      426b1f446f677435e50b196ad62c3013949359837a4d8cac38657a7f7e4fc92b

    • Size

      571KB

    • MD5

      cef81112287a623ee228f3a803f253c6

    • SHA1

      3f63d838832876589704ba5e9fabdcc8b2f96e88

    • SHA256

      426b1f446f677435e50b196ad62c3013949359837a4d8cac38657a7f7e4fc92b

    • SHA512

      d51d1ad8daf6ebf3f5b825b47f43c6e8a3babca92457c4567ecdc054fa1528cc68dbdcfe4592f15085d682b1d5a984004fa5c2100d65437bf16328733afba122

    Score
    10/10
    vobfuspersistenceworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks