Overview

overview

10

Static

static

SCAN-026764.pdf.msi

windows7_x64

10

SCAN-026764.pdf.msi

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SCAN-026764.pdf.msi

  • Size

    224KB

  • Sample

    220619-eb8axscghr

  • MD5

    d6a0e1a37a73098a9a7839b137521fe0

  • SHA1

    8f0c2d9bdbd1fca8b84cd2cc625607547036d8e6

  • SHA256

    e22ec74cd833a85882d5a8e76fa3b35daff0b7390bfbcd6b1ab270fd3741ceea

  • SHA512

    0ca3e6839950b0094d1c95647308ceab713ad23e69c73b10156ad4fef4c3f718c76ad5558260f89da84d2a2cd4b53e63a3cb9bc87d2fb47d580a36c9170b9653

Score
10/10
matanbuchusloadersuricata

Malware Config

Targets

    • Target

      SCAN-026764.pdf.msi

    • Size

      224KB

    • MD5

      d6a0e1a37a73098a9a7839b137521fe0

    • SHA1

      8f0c2d9bdbd1fca8b84cd2cc625607547036d8e6

    • SHA256

      e22ec74cd833a85882d5a8e76fa3b35daff0b7390bfbcd6b1ab270fd3741ceea

    • SHA512

      0ca3e6839950b0094d1c95647308ceab713ad23e69c73b10156ad4fef4c3f718c76ad5558260f89da84d2a2cd4b53e63a3cb9bc87d2fb47d580a36c9170b9653

    Score
    10/10
    matanbuchusloadersuricata

    • Matanbuchus

      A loader sold as MaaS first seen in February 2021.

      loadermatanbuchus

    • suricata: ET MALWARE Matanbuchus Loader CnC M1

      suricata: ET MALWARE Matanbuchus Loader CnC M1

      suricata

    • suricata: ET MALWARE Matanbuchus Loader CnC M3

      suricata: ET MALWARE Matanbuchus Loader CnC M3

      suricata

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks