Overview

overview

10

Static

static

800626880b...48.msi

windows7_x64

10

800626880b...48.msi

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    800626880b206896d6057ddf914d13dacaba7849c0499dae43c9a46a8062f448

  • Size

    216KB

  • Sample

    220128-yqmgjscfa9

  • MD5

    0bff7092fb2836a35f802140ffee8edc

  • SHA1

    bf32f5a6aa02f8d94406fdd14bb919e283af0499

  • SHA256

    800626880b206896d6057ddf914d13dacaba7849c0499dae43c9a46a8062f448

  • SHA512

    939ad07c4b9e0a8524ee9d1c9cc63310477a4e0a37f5527d8934b8d6dda29687dd1ff7bd33ee05be6b36102c667394f6a4a6756eb370c53136c35c928efe0211

Score
10/10
andromutdownloaderevasiontrojan

Malware Config

Targets

    • Target

      800626880b206896d6057ddf914d13dacaba7849c0499dae43c9a46a8062f448

    • Size

      216KB

    • MD5

      0bff7092fb2836a35f802140ffee8edc

    • SHA1

      bf32f5a6aa02f8d94406fdd14bb919e283af0499

    • SHA256

      800626880b206896d6057ddf914d13dacaba7849c0499dae43c9a46a8062f448

    • SHA512

      939ad07c4b9e0a8524ee9d1c9cc63310477a4e0a37f5527d8934b8d6dda29687dd1ff7bd33ee05be6b36102c667394f6a4a6756eb370c53136c35c928efe0211

    Score
    10/10
    andromutdownloaderevasiontrojan

    • Andromut

      AndroMut is a downloader written in C++, it was first observed in June 2019.

      trojandownloaderandromut

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks