Overview

overview

10

Static

static

load.msi

windows7_x64

10

load.msi

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    load.msi

  • Size

    548KB

  • Sample

    211004-wek38sghaq

  • MD5

    13173913da1f35728d84e78a3de983c9

  • SHA1

    9a1437af2d653fc265472a47edab9f22d49b1941

  • SHA256

    0e6451e1f0eadb89390f4360e2a49a2ffb66e92e8b3ae75400095e75f4dd6abb

  • SHA512

    3627ec46eb5b8cbdfd28015b38de6cd2279ff15be67e1a5d0c58a86fc1c165a39f4dd2d664977f7ce8a4ded9d2d678ce09c6fa3962e1b93f8543049313527a52

Score
10/10
mirrorblastloaderpersistencesuricata

Malware Config

Targets

    • Target

      load.msi

    • Size

      548KB

    • MD5

      13173913da1f35728d84e78a3de983c9

    • SHA1

      9a1437af2d653fc265472a47edab9f22d49b1941

    • SHA256

      0e6451e1f0eadb89390f4360e2a49a2ffb66e92e8b3ae75400095e75f4dd6abb

    • SHA512

      3627ec46eb5b8cbdfd28015b38de6cd2279ff15be67e1a5d0c58a86fc1c165a39f4dd2d664977f7ce8a4ded9d2d678ce09c6fa3962e1b93f8543049313527a52

    Score
    10/10
    persistencesuricatamirrorblastloader

    • MirrorBlast

      MirrorBlast is a script acting as loader for FlawedGrace RAT.

      loadermirrorblast

    • suricata: ET MALWARE MirrorBlast CnC Activity M2

      suricata: ET MALWARE MirrorBlast CnC Activity M2

      suricata

    • suricata: ET MALWARE MirrorBlast CnC Activity M3

      suricata: ET MALWARE MirrorBlast CnC Activity M3

      suricata

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks