Overview

overview

8

Static

static

QIAGEN Pro....3.scr

windows7_x64

8

QIAGEN Pro....3.scr

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QIAGEN Products Screensaver 1.2.3.scr

  • Size

    68.6MB

  • Sample

    210722-3d4vadgg1s

  • MD5

    dca1aac11e665c514f76a6c40bba0c2c

  • SHA1

    12de9458d9745ee95c50facb135eee7b32aaaaef

  • SHA256

    8ff3bb89a9a056079696e05263533821687633620b1f63577e81ca9d8fd8d257

  • SHA512

    ccfe9adbce515f1ebcbccfb616f69114532598aa59767ad6b847d7d4283f14a8b063be175ca7e632e53876ea1ca90ff977261ee8b6c168c59426e999b02760db

Score
8/10

Malware Config

Targets

    • Target

      QIAGEN Products Screensaver 1.2.3.scr

    • Size

      68.6MB

    • MD5

      dca1aac11e665c514f76a6c40bba0c2c

    • SHA1

      12de9458d9745ee95c50facb135eee7b32aaaaef

    • SHA256

      8ff3bb89a9a056079696e05263533821687633620b1f63577e81ca9d8fd8d257

    • SHA512

      ccfe9adbce515f1ebcbccfb616f69114532598aa59767ad6b847d7d4283f14a8b063be175ca7e632e53876ea1ca90ff977261ee8b6c168c59426e999b02760db

    Score
    8/10

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks