Resubmissions

27-06-2021 17:12

210627-33jllvhsl2 10

General

  • Target

    SignerLib.exe

  • Size

    6.8MB

  • Sample

    210627-33jllvhsl2

  • MD5

    796b3e4674b68b33c906ce32c3275d83

  • SHA1

    af8dc103b73c194816743ee22023a3cee934ac54

  • SHA256

    afb5cbe324865253c7a9dcadbe66c66746ea360f0cd184a2f4e1bbf104533ccd

  • SHA512

    1c47a540582e4030a5e4ffd91df559936f3e585d8e679eb4cf65a03740c35ac2f27126b21af107b08c33b301d6626ff8296be1789ee7638077fcd4ae451cd50c

Score
10/10

Malware Config

Extracted

Family

rustybuer

C2

https://usergtarca.com/

Targets

    • Target

      SignerLib.exe

    • Size

      6.8MB

    • MD5

      796b3e4674b68b33c906ce32c3275d83

    • SHA1

      af8dc103b73c194816743ee22023a3cee934ac54

    • SHA256

      afb5cbe324865253c7a9dcadbe66c66746ea360f0cd184a2f4e1bbf104533ccd

    • SHA512

      1c47a540582e4030a5e4ffd91df559936f3e585d8e679eb4cf65a03740c35ac2f27126b21af107b08c33b301d6626ff8296be1789ee7638077fcd4ae451cd50c

    Score
    10/10
    • RustyBuer

      RustyBuer is a new variant of Buer loader written in Rust.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks