Overview

overview

10

Static

static

c00a340c88...00.exe

windows7_x64

8

c00a340c88...00.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c00a340c884454bc13c1d60baacdead017846b8122fe720112fdd5ebad1e7700

  • Size

    1.9MB

  • Sample

    210517-nr35jcfkfx

  • MD5

    1e10c617422e53577aed7d2a3355ac60

  • SHA1

    67de1539735053e1463fb80548465bffd322f415

  • SHA256

    c00a340c884454bc13c1d60baacdead017846b8122fe720112fdd5ebad1e7700

  • SHA512

    b4e95c7e95f8625596f08d67c6f964269ab981d8c358ccd00630e88c0e0000f133824d6ca8c6c12caa60918cc408c175a48ac5fecd11aa3fad1fb86e404fb56d

Score
10/10
vobfuspersistenceworm

Malware Config

Targets

    • Target

      c00a340c884454bc13c1d60baacdead017846b8122fe720112fdd5ebad1e7700

    • Size

      1.9MB

    • MD5

      1e10c617422e53577aed7d2a3355ac60

    • SHA1

      67de1539735053e1463fb80548465bffd322f415

    • SHA256

      c00a340c884454bc13c1d60baacdead017846b8122fe720112fdd5ebad1e7700

    • SHA512

      b4e95c7e95f8625596f08d67c6f964269ab981d8c358ccd00630e88c0e0000f133824d6ca8c6c12caa60918cc408c175a48ac5fecd11aa3fad1fb86e404fb56d

    Score
    10/10
    persistencevobfusworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks