Overview

overview

10

Static

static

10

DualShot.exe

windows7_x64

10

DualShot.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DualShot.exe

  • Size

    19KB

  • Sample

    211022-g7l4nscahj

  • MD5

    acb31c8ebe9344ab41bdeec32d952499

  • SHA1

    15dad70b4b0061ab0db2de277595dcd4c8176eb0

  • SHA256

    6ca2a65b6c59c2147e49096df836c088a949ec47323cb99655558e18a22025fe

  • SHA512

    e562df64e35c710047d5d7aafda25305a24c5b7e1923924cf4b593defedfbff211b01f4c86795d573fe7af6db5a1a4d5afb98fc30ebb235d8b45977e2e004a8b

Score
10/10
dualshotpersistenceransomware

Malware Config

Targets

    • Target

      DualShot.exe

    • Size

      19KB

    • MD5

      acb31c8ebe9344ab41bdeec32d952499

    • SHA1

      15dad70b4b0061ab0db2de277595dcd4c8176eb0

    • SHA256

      6ca2a65b6c59c2147e49096df836c088a949ec47323cb99655558e18a22025fe

    • SHA512

      e562df64e35c710047d5d7aafda25305a24c5b7e1923924cf4b593defedfbff211b01f4c86795d573fe7af6db5a1a4d5afb98fc30ebb235d8b45977e2e004a8b

    Score
    10/10
    dualshotpersistenceransomware

    • DualShot

      Ransomware first seen in June 2020.

      ransomwaredualshot

    • DualShot Ransomware executable

      Detected known DualShot strings.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks