Overview

overview

10

Static

static

10

29cecf58ac...22.exe

windows7_x64

10

29cecf58ac...22.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29cecf58ac96b5a5a7af77f49154d4abcdeac232758d968da6473c65eb1aff22

  • Size

    8.4MB

  • Sample

    220615-qcv8jafhcp

  • MD5

    382e1fd1e08ca8b6c19b5a0792e23eee

  • SHA1

    1d683f336635ccd7a29b473e8168ba62d3d24e45

  • SHA256

    29cecf58ac96b5a5a7af77f49154d4abcdeac232758d968da6473c65eb1aff22

  • SHA512

    4a701bb7ac9d56205cd2cb6372c73d328e36673fa1a120246f2aeceda3d42357339d9f4731e791f992baf9468e5516da75000bf1a471d07e8709bd5493a6bcb3

Score
10/10
klingonpersistencetrojan

Malware Config

Targets

    • Target

      29cecf58ac96b5a5a7af77f49154d4abcdeac232758d968da6473c65eb1aff22

    • Size

      8.4MB

    • MD5

      382e1fd1e08ca8b6c19b5a0792e23eee

    • SHA1

      1d683f336635ccd7a29b473e8168ba62d3d24e45

    • SHA256

      29cecf58ac96b5a5a7af77f49154d4abcdeac232758d968da6473c65eb1aff22

    • SHA512

      4a701bb7ac9d56205cd2cb6372c73d328e36673fa1a120246f2aeceda3d42357339d9f4731e791f992baf9468e5516da75000bf1a471d07e8709bd5493a6bcb3

    Score
    10/10
    klingonpersistencetrojan

    • Klingon

      Klingon is a remote access trojan written in Golang with various capabilities.

      trojanklingon

    • Klingon RAT Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks