Overview

overview

10

Static

static

stress.exe

windows7_x64

10

stress.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    stress.exe

  • Size

    236KB

  • Sample

    220314-fxkx7afdfr

  • MD5

    34cfaa2b644090578848134694a9ebeb

  • SHA1

    4cccc6980db327256ddbd9e705dcbd5e2db06013

  • SHA256

    7c7ef413f202f872188b5f8bc03da7bcdc949e173e5ff36b3babec039df3e7ab

  • SHA512

    6a82385ef73fc4afdd0b23f1e802cba08d1e9a5da24be2d9cae62a129c9a4b4e86f99c9d3339323c2d6b36c29992e12964df19891baf8ed6cab6e306b0ccc952

Score
10/10
vobfuspersistencesuricataworm

Malware Config

Targets

    • Target

      stress.exe

    • Size

      236KB

    • MD5

      34cfaa2b644090578848134694a9ebeb

    • SHA1

      4cccc6980db327256ddbd9e705dcbd5e2db06013

    • SHA256

      7c7ef413f202f872188b5f8bc03da7bcdc949e173e5ff36b3babec039df3e7ab

    • SHA512

      6a82385ef73fc4afdd0b23f1e802cba08d1e9a5da24be2d9cae62a129c9a4b4e86f99c9d3339323c2d6b36c29992e12964df19891baf8ed6cab6e306b0ccc952

    Score
    10/10
    vobfuspersistencesuricataworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • suricata: ET MALWARE BlackshadesRAT Reporting

      suricata: ET MALWARE BlackshadesRAT Reporting

      suricata

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks