Overview

overview

8

Static

static

be72f225d1...74.exe

windows7_x64

8

be72f225d1...74.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be72f225d1595ffe5c22c1f7adc4fc74

  • Size

    1.0MB

  • Sample

    211114-hs782agac5

  • MD5

    be72f225d1595ffe5c22c1f7adc4fc74

  • SHA1

    14ed85007d7c4b4368d8c101c0e19b337a3dd084

  • SHA256

    2585845349d420cec529b285a268b989ba28f135aa5332d3ce9122bbf53b5ce4

  • SHA512

    7a8e8e2b057776d4eacf3939e88509ac16b9544d4ff2d97d5a5060fda860aa44b49cd13212c26f25ddc255c03a3d7b1cfd8213edcc595134b2a127b4f07be6cb

Score
8/10
agilenet

Malware Config

Targets

    • Target

      be72f225d1595ffe5c22c1f7adc4fc74

    • Size

      1.0MB

    • MD5

      be72f225d1595ffe5c22c1f7adc4fc74

    • SHA1

      14ed85007d7c4b4368d8c101c0e19b337a3dd084

    • SHA256

      2585845349d420cec529b285a268b989ba28f135aa5332d3ce9122bbf53b5ce4

    • SHA512

      7a8e8e2b057776d4eacf3939e88509ac16b9544d4ff2d97d5a5060fda860aa44b49cd13212c26f25ddc255c03a3d7b1cfd8213edcc595134b2a127b4f07be6cb

    Score
    8/10
    agilenet

    • Executes dropped EXE

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks