af48e55bb79caba8acccaa8a9498874db7cbf46d3ed696e7b0ce32ad157abbc2 | Triage

Sharing

General

Target

af48e55bb79caba8acccaa8a9498874db7cbf46d3ed696e7b0ce32ad157abbc2.sample
Size

200KB
Sample

210726-28zq4w68bj
MD5

f5ae9882f079c34f21eb9649b6f79724
SHA1

78f92938f0f9e5f5e1470eeaea9841e8e53c3fda
SHA256

af48e55bb79caba8acccaa8a9498874db7cbf46d3ed696e7b0ce32ad157abbc2
SHA512

ca92229a2ad7234276cdb8aa8df1d1349560af47607660089bdeffcf53e06be52d2657887e85cbfc70ecf12d4782699eaa009f2b6c86f0c09af80a97481ee13c

Score

10^/10

evasion persistence ransomware spyware stealer suricata trojan

Malware Config

Targets

- Target
  
  af48e55bb79caba8acccaa8a9498874db7cbf46d3ed696e7b0ce32ad157abbc2.sample
- Size
  
  200KB
- MD5
  
  f5ae9882f079c34f21eb9649b6f79724
- SHA1
  
  78f92938f0f9e5f5e1470eeaea9841e8e53c3fda
- SHA256
  
  af48e55bb79caba8acccaa8a9498874db7cbf46d3ed696e7b0ce32ad157abbc2
- SHA512
  
  ca92229a2ad7234276cdb8aa8df1d1349560af47607660089bdeffcf53e06be52d2657887e85cbfc70ecf12d4782699eaa009f2b6c86f0c09af80a97481ee13c
Score

10^/10

evasion persistence ransomware suricata trojan spyware stealer
- suricata: ET MALWARE TorrentLocker DNS Lookup
  suricata
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasionpersistenceransomwaresuricatatrojan

behavioral2

evasionpersistenceransomwarespywarestealersuricatatrojan