Overview

overview

10

Static

static

ad810c4530...17.exe

windows7_x64

8

ad810c4530...17.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad810c453011ad8fb51960364e6ce93ca44b9f51506a09fe3030d20e9cd2d717

  • Size

    446KB

  • Sample

    210516-rvga4c9kr6

  • MD5

    530838b1af7ef222921d9825697f25c9

  • SHA1

    969506b1f0adadd70bf0b705316bc97fba662bf9

  • SHA256

    ad810c453011ad8fb51960364e6ce93ca44b9f51506a09fe3030d20e9cd2d717

  • SHA512

    f0adf5b45f100fd36fdea83275aa34d5b2ad429f94839b673a57b16ac43f97c2870ca6416fb4251932c28cee9cd5ae2d3f30a6e634604668bb6dd9ece4e95d66

Score
10/10
vobfuspersistenceworm

Malware Config

Targets

    • Target

      ad810c453011ad8fb51960364e6ce93ca44b9f51506a09fe3030d20e9cd2d717

    • Size

      446KB

    • MD5

      530838b1af7ef222921d9825697f25c9

    • SHA1

      969506b1f0adadd70bf0b705316bc97fba662bf9

    • SHA256

      ad810c453011ad8fb51960364e6ce93ca44b9f51506a09fe3030d20e9cd2d717

    • SHA512

      f0adf5b45f100fd36fdea83275aa34d5b2ad429f94839b673a57b16ac43f97c2870ca6416fb4251932c28cee9cd5ae2d3f30a6e634604668bb6dd9ece4e95d66

    Score
    10/10
    persistencevobfusworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks