Overview

overview

8

Static

static

10

ed3edf8fdb...19.msi

windows7_x64

8

ed3edf8fdb...19.msi

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed3edf8fdb2cd2f027127f4fb1fe7019.msi

  • Size

    264KB

  • Sample

    211022-jqzdsabcf5

  • MD5

    ed3edf8fdb2cd2f027127f4fb1fe7019

  • SHA1

    e876622ade868b5c8461b80a9b8e4961e9427b2e

  • SHA256

    ece2bea42a77b9c098899150a002e9f702cc7cf5b43bc8f674c61d5adaf905d3

  • SHA512

    051d9ff3bc18233ee3174113b566a1bbd653588b9070563f9627c51315cd0e39bc6151a92f5df91cc8c809cd021ae79ab43ac0b88013930f7da7864c68a10d42

Score
10/10
latam_generic_downloader

Malware Config

Extracted

Family

latam_generic_downloader

C2

https://s7h3bdd733d.s3.sa-east-1.amazonaws.com/libeay32.criss

Targets

    • Target

      ed3edf8fdb2cd2f027127f4fb1fe7019.msi

    • Size

      264KB

    • MD5

      ed3edf8fdb2cd2f027127f4fb1fe7019

    • SHA1

      e876622ade868b5c8461b80a9b8e4961e9427b2e

    • SHA256

      ece2bea42a77b9c098899150a002e9f702cc7cf5b43bc8f674c61d5adaf905d3

    • SHA512

      051d9ff3bc18233ee3174113b566a1bbd653588b9070563f9627c51315cd0e39bc6151a92f5df91cc8c809cd021ae79ab43ac0b88013930f7da7864c68a10d42

    Score
    8/10

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks