General

  • Target

    Key.exe

  • Size

    6.8MB

  • Sample

    210716-jnm8jhv6zj

  • MD5

    963a91ca9da30098c75ecd5ab275f76c

  • SHA1

    aff6c60c43a8900f9a9c2d11a604270c035c543c

  • SHA256

    578dc62dfa0203080da262676f28c679114d6b1c90a4ab6c07b736d9ce64e43e

  • SHA512

    9fc6603359f80b9e5db7a02a91ce7b22765871fff98310c0679e7f970807534cd8645dde948dc58b2ca079f8ca3b209ac675599d8f9b3edfb7c35230e674449e

Score
10/10

Malware Config

Extracted

Family

rustybuer

C2

https://lebatyo.com/

Targets

    • Target

      Key.exe

    • Size

      6.8MB

    • MD5

      963a91ca9da30098c75ecd5ab275f76c

    • SHA1

      aff6c60c43a8900f9a9c2d11a604270c035c543c

    • SHA256

      578dc62dfa0203080da262676f28c679114d6b1c90a4ab6c07b736d9ce64e43e

    • SHA512

      9fc6603359f80b9e5db7a02a91ce7b22765871fff98310c0679e7f970807534cd8645dde948dc58b2ca079f8ca3b209ac675599d8f9b3edfb7c35230e674449e

    Score
    10/10
    • RustyBuer

      RustyBuer is a new variant of Buer loader written in Rust.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks