Overview

overview

10

Static

static

Document-1310.iso

windows7_x64

3

Document-1310.iso

windows10-2004_x64

3

1662.ps1

windows7_x64

1

1662.ps1

windows10-2004_x64

10

Scan_139.jpg

windows7_x64

3

Scan_139.jpg

windows10-2004_x64

3

Scan_139.jpg.lnk

windows7_x64

3

Scan_139.jpg.lnk

windows10-2004_x64

10

x.txt

windows7_x64

1

x.txt

windows10-2004_x64

1

Resubmissions

05-06-2022 15:10

220605-sj6zqabfd5 8

02-06-2022 19:49

220602-yjvvcabad9 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Document-1310.iso

  • Size

    338KB

  • Sample

    220602-yjvvcabad9

  • MD5

    ba10e6e571578304126a889202571e1b

  • SHA1

    4a5d5a50503bc96e50b103981f05373982ecf307

  • SHA256

    692ad829cb6c9788998acb106ea4d8311e432c866d082ac3cc117166ac50080d

  • SHA512

    aa0971e9169786e65407aae13a05b23710abda00c23d5103434ac655183670248a19736153c2528661f6dd7fcf46bc03df2c9264b84e24464aaa7ad916f6c40b

Score
10/10
doublebackbackdoor

Malware Config

Targets

    • Target

      Document-1310.iso

    • Size

      338KB

    • MD5

      ba10e6e571578304126a889202571e1b

    • SHA1

      4a5d5a50503bc96e50b103981f05373982ecf307

    • SHA256

      692ad829cb6c9788998acb106ea4d8311e432c866d082ac3cc117166ac50080d

    • SHA512

      aa0971e9169786e65407aae13a05b23710abda00c23d5103434ac655183670248a19736153c2528661f6dd7fcf46bc03df2c9264b84e24464aaa7ad916f6c40b

    Score
    3/10
    behavioral1behavioral2

    • Target

      1662.ps1

    • Size

      192KB

    • MD5

      3f5498ca9c0d3d185bc45edf45185d07

    • SHA1

      f945b742489e29dff58fd41a4f6293b6deb57533

    • SHA256

      caa1268740d0b48795621f8d0e127fd4574c87de5c16f5348fadc97866d1de39

    • SHA512

      34849f297613c9c2b284704e65701aa88ded0ccea1956d55233a052810149b81489c4e7b6bd0416b53d394ec676221527fbe700434756ed04827b5b9bad0334c

    Score
    10/10
    doublebackbackdoor

    • DoubleBack

      DoubleBack is a modular backdoor first seen in December 2020.

      backdoordoubleback

    • DoubleBack x64 Payload

    • Blocklisted process makes network request

    behavioral3behavioral4

    • Target

      Scan_139.jpg

    • Size

      88KB

    • MD5

      f9b2333cc7e93568486a672225f2dd69

    • SHA1

      c0143893cd2461fb2dc2c84330c1bf469dc93c34

    • SHA256

      7e3875bf31005d9d352d9b029e4364df19dccf6c77f16539ca974f224a30347c

    • SHA512

      d30732aba584782ef2783f388ca9183f9c4b02ec6b3e8741a91fae152f2bae19b655a53d19fc2cdbf85a0da3621d0de6c50129435b6ba937a083416d2d22c7f1

    Score
    3/10
    behavioral5behavioral6

    • Target

      Scan_139.jpg.lnk

    • Size

      1KB

    • MD5

      ae4d8e1b3f31028acb611bdefbfa51b2

    • SHA1

      6327c8798e529dd479e7bdd99c314867a7cccd3b

    • SHA256

      f73826aa0bdf74bc777023b1e2c05fbb79194f81be1c2977af1fcbe6298740ff

    • SHA512

      4bc8d72294ee65c89e0a0815321e1d67ae9f3ed43d7dd7aabc3fc05d02c766ff68664873265e3ef01e1fee12807d9b52c218d23d03b0fd91520ab853ea883557

    Score
    10/10
    doublebackbackdoor

    • DoubleBack

      DoubleBack is a modular backdoor first seen in December 2020.

      backdoordoubleback

    • DoubleBack x64 Payload

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral7behavioral8

    • Target

      x.txt

    • Size

      289B

    • MD5

      072009e7e44a2a75b9c9398e5263cc04

    • SHA1

      07649472a1ab42cf1d29de040f3adf1cd7bb21fa

    • SHA256

      56e9baf765a043889efa1695e48d342057bb3e70adc723cbd96135fe1764fd3e

    • SHA512

      b67c426b9f4e0d070c526e1c060d271c3875f0f9ba58e782ff78aec02b3a7f2a34b551f43e97947fecebca3ea337e08eedcc29a4583a3ad6d42e74d60bb7be6d

    Score
    1/10
    behavioral9behavioral10

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks