General

  • Target

    9ce4835ef1842b7407b3c8777a6495ceb1b69dac0c13f7059c2fec1b2c209cb1

  • Size

    409KB

  • Sample

    220204-xb9g4aeabk

  • MD5

    d1b867b08265e436af211eb1a72e1705

  • SHA1

    f6cbaa3538d2a990feebd5edc4ac62067290f1b8

  • SHA256

    9ce4835ef1842b7407b3c8777a6495ceb1b69dac0c13f7059c2fec1b2c209cb1

  • SHA512

    529efd71b8d3bb3d52a0ee7dc98710b24147fce60c31fc6cc67fd89396f32a61372b8d6e770a1a2ee1127ba146b8af86bd9b2e06eb59e49b70e4e1cc5b8d340a

Malware Config

Targets

    • Target

      9ce4835ef1842b7407b3c8777a6495ceb1b69dac0c13f7059c2fec1b2c209cb1

    • Size

      409KB

    • MD5

      d1b867b08265e436af211eb1a72e1705

    • SHA1

      f6cbaa3538d2a990feebd5edc4ac62067290f1b8

    • SHA256

      9ce4835ef1842b7407b3c8777a6495ceb1b69dac0c13f7059c2fec1b2c209cb1

    • SHA512

      529efd71b8d3bb3d52a0ee7dc98710b24147fce60c31fc6cc67fd89396f32a61372b8d6e770a1a2ee1127ba146b8af86bd9b2e06eb59e49b70e4e1cc5b8d340a

    • Valak

      Valak is a JavaScript loader, a link in a chain of distribution of other malware families.

    • Valak JavaScript Loader

    • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

      suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    • Blocklisted process makes network request

    • Sets service image path in registry

MITRE ATT&CK Enterprise v6

Tasks