Overview

overview

10

Static

static

95f5279781...37.exe

windows7_x64

10

95f5279781...37.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    95f527978167cc6a45e4d42ec7852cd31a12d6413523fa573a85b44ec9886637

  • Size

    764KB

  • Sample

    210903-k2rzhscha4

  • MD5

    75620fdd5d0f2b9bca53bfb8496e7528

  • SHA1

    09b9d75339adabef72a54a09736e03a69c6f26a6

  • SHA256

    95f527978167cc6a45e4d42ec7852cd31a12d6413523fa573a85b44ec9886637

  • SHA512

    e3cc6684462eabc15e7aba435135737c540c7337fdf1657260981ff1be1b4db13bc260e93c1bc8277fb20aa843105d10d68da76fe76f65c454d033a92aa4f3c9

Score
10/10
vobfuspersistenceworm

Malware Config

Targets

    • Target

      95f527978167cc6a45e4d42ec7852cd31a12d6413523fa573a85b44ec9886637

    • Size

      764KB

    • MD5

      75620fdd5d0f2b9bca53bfb8496e7528

    • SHA1

      09b9d75339adabef72a54a09736e03a69c6f26a6

    • SHA256

      95f527978167cc6a45e4d42ec7852cd31a12d6413523fa573a85b44ec9886637

    • SHA512

      e3cc6684462eabc15e7aba435135737c540c7337fdf1657260981ff1be1b4db13bc260e93c1bc8277fb20aa843105d10d68da76fe76f65c454d033a92aa4f3c9

    Score
    10/10
    vobfuspersistenceworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks