Overview

overview

10

Static

static

load.msi

windows7_x64

10

load.msi

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    load.msi
  • Size 548KB
  • Sample211013-qec5qsdhgl
  • SHA256 eceb164a69e8f79bb08099fcdf2b75071c527b0107daebc0e7a88e246b4c7f13
  • MD5 SHA1 SHA512
Score
10/10
mirrorblastloaderpersistencesuricata

Malware Config

Targets

    • Target
      load.msi
    • Size 548KB
    • SHA256 eceb164a69e8f79bb08099fcdf2b75071c527b0107daebc0e7a88e246b4c7f13
    • MD5 SHA1 SHA512
    Score
    10/10
    persistencesuricatamirrorblastloader

    • MirrorBlast

      MirrorBlast is a script acting as loader for FlawedGrace RAT.

      loadermirrorblast

    • suricata: ET MALWARE MirrorBlast CnC Activity M2

      suricata: ET MALWARE MirrorBlast CnC Activity M2

      suricata

    • suricata: ET MALWARE MirrorBlast CnC Activity M3

      suricata: ET MALWARE MirrorBlast CnC Activity M3

      suricata

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks