Overview

overview

8

Static

static

3

malware.exe

windows7_x64

7

malware.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    malware.exe

  • Size

    6.7MB

  • Sample

    211010-yj6a3sgban

  • MD5

    536444a6c9cdc019b47330725e1ac0d2

  • SHA1

    7c01fc6c4a6ce3710a3462bec304ee483f7a5910

  • SHA256

    0055fab035e9d26b72bb550b88eba4972f56d3885c0b013a83286bdeb7496de1

  • SHA512

    17782dfd7c742596450d7aeed3ccbe87c3e122e7298d2f164f792a40ed846aa05d9b404d2d9b132466fff595d77e215a509c7692d2b7a5849c6135592d7fff7b

Score
8/10
persistencepyinstaller

Malware Config

Targets

    • Target

      malware.exe

    • Size

      6.7MB

    • MD5

      536444a6c9cdc019b47330725e1ac0d2

    • SHA1

      7c01fc6c4a6ce3710a3462bec304ee483f7a5910

    • SHA256

      0055fab035e9d26b72bb550b88eba4972f56d3885c0b013a83286bdeb7496de1

    • SHA512

      17782dfd7c742596450d7aeed3ccbe87c3e122e7298d2f164f792a40ed846aa05d9b404d2d9b132466fff595d77e215a509c7692d2b7a5849c6135592d7fff7b

    Score
    8/10
    persistence

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks