Overview

overview

10

Static

static

4afc73a0aa...27.exe

windows7_x64

10

4afc73a0aa...27.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4afc73a0aae35d18bc18239df2efb48bd76335ffee4a3e042f6617c10f867227

  • Size

    261KB

  • Sample

    210517-yxkk9nz12e

  • MD5

    ca1e0a13c7a31f84d9ef83e9e64c04b0

  • SHA1

    a1b6bcabf688cb8677f7298601f12bd96cdcd16b

  • SHA256

    4afc73a0aae35d18bc18239df2efb48bd76335ffee4a3e042f6617c10f867227

  • SHA512

    29454bb95f4caa7bdfba74bbbd503ed3664d4ea4d918c05c354fc821bc2281244bc1e3d635aaf0cd1c0333244589478dc166d971b1e1688041d00815474a63eb

Score
10/10
vobfuspersistenceworm

Malware Config

Targets

    • Target

      4afc73a0aae35d18bc18239df2efb48bd76335ffee4a3e042f6617c10f867227

    • Size

      261KB

    • MD5

      ca1e0a13c7a31f84d9ef83e9e64c04b0

    • SHA1

      a1b6bcabf688cb8677f7298601f12bd96cdcd16b

    • SHA256

      4afc73a0aae35d18bc18239df2efb48bd76335ffee4a3e042f6617c10f867227

    • SHA512

      29454bb95f4caa7bdfba74bbbd503ed3664d4ea4d918c05c354fc821bc2281244bc1e3d635aaf0cd1c0333244589478dc166d971b1e1688041d00815474a63eb

    Score
    10/10
    vobfuspersistenceworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks