Overview

overview

10

Static

static

ca6b1afe76...71.exe

windows7_x64

10

ca6b1afe76...71.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca6b1afe76cbc6f14e10608b426d7c6c028ab78de5cca30ae7b5880710865171

  • Size

    783KB

  • Sample

    220524-3ld2tsbgd8

  • MD5

    af453e6dc8439e4856260859e7d68fc1

  • SHA1

    031520acf4961f5938f0ceeb2f02e2656667cffb

  • SHA256

    ca6b1afe76cbc6f14e10608b426d7c6c028ab78de5cca30ae7b5880710865171

  • SHA512

    434afe14ea03edb8988ca23785275a63f8398936811f0b86215c1f4b3f165fc0da352e01aa16206e6f28bf93dee4c0ec21882b08b35adedb55052d7fb54136e3

Score
10/10
hiveratevasionpersistenceratstealertrojan

Malware Config

Targets

    • Target

      ca6b1afe76cbc6f14e10608b426d7c6c028ab78de5cca30ae7b5880710865171

    • Size

      783KB

    • MD5

      af453e6dc8439e4856260859e7d68fc1

    • SHA1

      031520acf4961f5938f0ceeb2f02e2656667cffb

    • SHA256

      ca6b1afe76cbc6f14e10608b426d7c6c028ab78de5cca30ae7b5880710865171

    • SHA512

      434afe14ea03edb8988ca23785275a63f8398936811f0b86215c1f4b3f165fc0da352e01aa16206e6f28bf93dee4c0ec21882b08b35adedb55052d7fb54136e3

    Score
    10/10
    hiveratevasionpersistenceratstealertrojan

    • HiveRAT

      HiveRAT is an improved version of FirebirdRAT with various capabilities.

      ratstealerhiverat

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • HiveRAT Payload

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

2
T1089

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks