Overview

overview

10

Static

static

10

6c7847d103...8d.exe

windows7_x64

10

6c7847d103...8d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c7847d103de865f906c2e1b7372f2e11ceebec890a68ee6532cebeab852618d

  • Size

    162KB

  • Sample

    220128-we22rahfgp

  • MD5

    dd1d2518d48b0c9b15dc426816f627b5

  • SHA1

    e26d5ed1aa0c38a64f0f9c2f85fc144b320c0147

  • SHA256

    6c7847d103de865f906c2e1b7372f2e11ceebec890a68ee6532cebeab852618d

  • SHA512

    dea2c64e3b245d00afc1bfa0b8f2e8baa9559e11b1af81dc25eb8d9a6e17460be9357aa3ba0a3f2d2a618b550a45a9ec23a1fe3edf0a123dc0bb95901d1b4840

Score
10/10
anchordnsbackdoor

Malware Config

Targets

    • Target

      6c7847d103de865f906c2e1b7372f2e11ceebec890a68ee6532cebeab852618d

    • Size

      162KB

    • MD5

      dd1d2518d48b0c9b15dc426816f627b5

    • SHA1

      e26d5ed1aa0c38a64f0f9c2f85fc144b320c0147

    • SHA256

      6c7847d103de865f906c2e1b7372f2e11ceebec890a68ee6532cebeab852618d

    • SHA512

      dea2c64e3b245d00afc1bfa0b8f2e8baa9559e11b1af81dc25eb8d9a6e17460be9357aa3ba0a3f2d2a618b550a45a9ec23a1fe3edf0a123dc0bb95901d1b4840

    Score
    10/10
    anchordnsbackdoor

    • AnchorDNS Backdoor

      A backdoor which communicates with C2 through DNS, attributed to the creators of Trickbot and Bazar.

      backdooranchordns

    • Detected AnchorDNS Backdoor

      Sample triggered yara rules associated with the AnchorDNS malware family.

      backdoor

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks