Overview

overview

10

Static

static

5710f181a8...d5.exe

windows7-x64

10

5710f181a8...d5.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5710f181a84b13daec084af3c60d955141cd25bbe9db0b3a676f481dda68e5d5

  • Size

    189KB

  • Sample

    220725-a7cfxagbcl

  • MD5

    63c3a180a9654ea1ad00bd2b683637b0

  • SHA1

    525b9d69be05ae85e723488108f5733a63a38fec

  • SHA256

    5710f181a84b13daec084af3c60d955141cd25bbe9db0b3a676f481dda68e5d5

  • SHA512

    0cf6540a61258da449313dd1731adef5d21434018cda61494019dcbdfa59800595d5bb82d6e9c91c491c846ae04db1275e1ad1f903399eef3d1438ab72dcecdc

Score
10/10
evasionpersistencesuricatatrojan

Malware Config

Targets

    • Target

      5710f181a84b13daec084af3c60d955141cd25bbe9db0b3a676f481dda68e5d5

    • Size

      189KB

    • MD5

      63c3a180a9654ea1ad00bd2b683637b0

    • SHA1

      525b9d69be05ae85e723488108f5733a63a38fec

    • SHA256

      5710f181a84b13daec084af3c60d955141cd25bbe9db0b3a676f481dda68e5d5

    • SHA512

      0cf6540a61258da449313dd1731adef5d21434018cda61494019dcbdfa59800595d5bb82d6e9c91c491c846ae04db1275e1ad1f903399eef3d1438ab72dcecdc

    Score
    10/10
    evasionpersistencesuricatatrojan

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

      suricata

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Disables taskbar notifications via registry modification

      evasion

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

3
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks