Overview

overview

10

Static

static

10

f7278cd220...f3.exe

windows7_x64

10

f7278cd220...f3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7278cd22070f0418ac75b599b8bcc524ee9d6adbda4103d149c9484cdaeb4f3

  • Size

    162KB

  • Sample

    220128-w2m64safe9

  • MD5

    35229446728ec9bbeae1599c13e86d82

  • SHA1

    c759203d19d86540b6c1efa6eec6aab9ed25470d

  • SHA256

    f7278cd22070f0418ac75b599b8bcc524ee9d6adbda4103d149c9484cdaeb4f3

  • SHA512

    597b3a0e315752ac24bcd11ea2992bdc6c47c575f6385b209a56065da35a074340aceb56f01d29e7486e84bf3cb124d3f00adff399cebca3cbfa219ebb2b5feb

Score
10/10
anchordnsbackdoor

Malware Config

Targets

    • Target

      f7278cd22070f0418ac75b599b8bcc524ee9d6adbda4103d149c9484cdaeb4f3

    • Size

      162KB

    • MD5

      35229446728ec9bbeae1599c13e86d82

    • SHA1

      c759203d19d86540b6c1efa6eec6aab9ed25470d

    • SHA256

      f7278cd22070f0418ac75b599b8bcc524ee9d6adbda4103d149c9484cdaeb4f3

    • SHA512

      597b3a0e315752ac24bcd11ea2992bdc6c47c575f6385b209a56065da35a074340aceb56f01d29e7486e84bf3cb124d3f00adff399cebca3cbfa219ebb2b5feb

    Score
    10/10
    anchordnsbackdoor

    • AnchorDNS Backdoor

      A backdoor which communicates with C2 through DNS, attributed to the creators of Trickbot and Bazar.

      backdooranchordns

    • Detected AnchorDNS Backdoor

      Sample triggered yara rules associated with the AnchorDNS malware family.

      backdoor

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks