Overview

overview

10

Static

static

load.msi

windows7_x64

10

load.msi

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    load.msi

  • Size

    548KB

  • Sample

    211013-qec5qsdhgl

  • MD5

    dffb3d323708f624dc3469e99c3adcb3

  • SHA1

    043620bdea4fd9d48673db8081ffbd9f25d1d8ac

  • SHA256

    eceb164a69e8f79bb08099fcdf2b75071c527b0107daebc0e7a88e246b4c7f13

  • SHA512

    a30b70e5bb259410606d5e123e17b8502423912ecedf6d6ebad6b180a372c58f36231f0c85b610ad89e5328b1e63e257be932d4d3fea8971853516e31f531f84

Score
10/10
mirrorblastloaderpersistencesuricata

Malware Config

Targets

    • Target

      load.msi

    • Size

      548KB

    • MD5

      dffb3d323708f624dc3469e99c3adcb3

    • SHA1

      043620bdea4fd9d48673db8081ffbd9f25d1d8ac

    • SHA256

      eceb164a69e8f79bb08099fcdf2b75071c527b0107daebc0e7a88e246b4c7f13

    • SHA512

      a30b70e5bb259410606d5e123e17b8502423912ecedf6d6ebad6b180a372c58f36231f0c85b610ad89e5328b1e63e257be932d4d3fea8971853516e31f531f84

    Score
    10/10
    persistencesuricatamirrorblastloader

    • MirrorBlast

      MirrorBlast is a script acting as loader for FlawedGrace RAT.

      loadermirrorblast

    • suricata: ET MALWARE MirrorBlast CnC Activity M2

      suricata: ET MALWARE MirrorBlast CnC Activity M2

      suricata

    • suricata: ET MALWARE MirrorBlast CnC Activity M3

      suricata: ET MALWARE MirrorBlast CnC Activity M3

      suricata

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks