Overview

overview

10

Static

static

3958.exe

windows7_x64

10

3958.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3958.exe

  • Size

    220KB

  • Sample

    220315-we8vasebe6

  • MD5

    2ace87034adcea65a2f266aaad73f734

  • SHA1

    6b58441ecb9b5ed42a03f9e16399ffc0600a7352

  • SHA256

    39586d1d2708b26ebcb188599b9564f8657b879f32c27c1a156288c0399fa83e

  • SHA512

    2098e9c1d1fcbdf72023f3415416372f536f42911a0b3e82d8a2df15a26fff8b3dc9159c25713b973df02fc32e03f12212199d155e7107ba0f2758bae71191fc

Score
10/10
vobfuspersistenceworm

Malware Config

Targets

    • Target

      3958.exe

    • Size

      220KB

    • MD5

      2ace87034adcea65a2f266aaad73f734

    • SHA1

      6b58441ecb9b5ed42a03f9e16399ffc0600a7352

    • SHA256

      39586d1d2708b26ebcb188599b9564f8657b879f32c27c1a156288c0399fa83e

    • SHA512

      2098e9c1d1fcbdf72023f3415416372f536f42911a0b3e82d8a2df15a26fff8b3dc9159c25713b973df02fc32e03f12212199d155e7107ba0f2758bae71191fc

    Score
    10/10
    vobfuspersistenceworm

    • Vobfus

      A widespread worm which spreads via network drives and removable media.

      wormvobfus

    • Adds policy Run key to start application

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks