Overview

overview

10

Static

static

010e6ced87...a2.exe

windows7_x64

10

010e6ced87...a2.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    010e6ced8773f81e96bcbffad26fdf095672d51c5aece06b615692e0409f45a2

  • Size

    160KB

  • Sample

    220128-2pb6zafha7

  • MD5

    0cbeb424d96e5c268ec2525d603f64eb

  • SHA1

    3e3229122735a3c76f3c9696a6bcff3604616b90

  • SHA256

    010e6ced8773f81e96bcbffad26fdf095672d51c5aece06b615692e0409f45a2

  • SHA512

    34eda91f5c670b6672fdceba8f80b87b9bf9e7734c950542bdeb0b1c9494c70ad4f1085255ba12372cb8006388ee40ed5ed25ca4e0eec6e597b2f32092a19189

Score
10/10
andromutdownloaderevasiontrojan

Malware Config

Targets

    • Target

      010e6ced8773f81e96bcbffad26fdf095672d51c5aece06b615692e0409f45a2

    • Size

      160KB

    • MD5

      0cbeb424d96e5c268ec2525d603f64eb

    • SHA1

      3e3229122735a3c76f3c9696a6bcff3604616b90

    • SHA256

      010e6ced8773f81e96bcbffad26fdf095672d51c5aece06b615692e0409f45a2

    • SHA512

      34eda91f5c670b6672fdceba8f80b87b9bf9e7734c950542bdeb0b1c9494c70ad4f1085255ba12372cb8006388ee40ed5ed25ca4e0eec6e597b2f32092a19189

    Score
    10/10
    andromutdownloaderevasiontrojan

    • Andromut

      AndroMut is a downloader written in C++, it was first observed in June 2019.

      trojandownloaderandromut

    • Executes dropped EXE

    • Deletes itself

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks