Overview

overview

10

Static

static

1662.ps1

windows7_x64

1

1662.ps1

windows10-2004_x64

10

Scan_139.jpg.lnk

windows7_x64

3

Scan_139.jpg.lnk

windows10-2004_x64

8

Resubmissions

04-06-2022 11:20

220604-nfxvesdca7 8

03-06-2022 12:14

220603-peczasegb4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Document-1310.iso

  • Size

    338KB

  • Sample

    220603-peczasegb4

  • MD5

    ba10e6e571578304126a889202571e1b

  • SHA1

    4a5d5a50503bc96e50b103981f05373982ecf307

  • SHA256

    692ad829cb6c9788998acb106ea4d8311e432c866d082ac3cc117166ac50080d

  • SHA512

    aa0971e9169786e65407aae13a05b23710abda00c23d5103434ac655183670248a19736153c2528661f6dd7fcf46bc03df2c9264b84e24464aaa7ad916f6c40b

Score
10/10
doublebackbackdoor

Malware Config

Targets

    • Target

      1662.ps1

    • Size

      192KB

    • MD5

      3f5498ca9c0d3d185bc45edf45185d07

    • SHA1

      f945b742489e29dff58fd41a4f6293b6deb57533

    • SHA256

      caa1268740d0b48795621f8d0e127fd4574c87de5c16f5348fadc97866d1de39

    • SHA512

      34849f297613c9c2b284704e65701aa88ded0ccea1956d55233a052810149b81489c4e7b6bd0416b53d394ec676221527fbe700434756ed04827b5b9bad0334c

    Score
    10/10
    doublebackbackdoor

    • DoubleBack

      DoubleBack is a modular backdoor first seen in December 2020.

      backdoordoubleback

    • DoubleBack x64 Payload

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      Scan_139.jpg.lnk

    • Size

      1KB

    • MD5

      ae4d8e1b3f31028acb611bdefbfa51b2

    • SHA1

      6327c8798e529dd479e7bdd99c314867a7cccd3b

    • SHA256

      f73826aa0bdf74bc777023b1e2c05fbb79194f81be1c2977af1fcbe6298740ff

    • SHA512

      4bc8d72294ee65c89e0a0815321e1d67ae9f3ed43d7dd7aabc3fc05d02c766ff68664873265e3ef01e1fee12807d9b52c218d23d03b0fd91520ab853ea883557

    Score
    8/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks