Overview

overview

10

Static

static

91791f8c45...7e.exe

windows7-x64

10

91791f8c45...7e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91791f8c459f32dc9bf6ec9f7ee157e322b252bc74b1142705dcc74fe8eced7e

  • Size

    62KB

  • Sample

    220819-k7ma8abcem

  • MD5

    e538190af9ed2ee602d3cbbe25fd1d78

  • SHA1

    9649f68d1de493b0f17d93b33c2e6bd0ff149e1e

  • SHA256

    91791f8c459f32dc9bf6ec9f7ee157e322b252bc74b1142705dcc74fe8eced7e

  • SHA512

    99b29ef2c068da8d0d50927463257ae1e90b30dab4114af3c5300084b2a6bbdc1d8b67bc9e3cd6d8bd3320c56bb255f7de3a9f60363f2bc0935603e8929eb99b

  • SSDEEP

    768:eUcljbdbaduiSpAmHGHuGFOChjPpcPO2hbdtVWfCoJAvVfjgK+v1Pshc5HFe0jwJ:ABdb1iMASmICZptCX5jRUGgjjvI10w

Score
10/10
netdookaloaderpersistencerat

Malware Config

Extracted

Family

netdooka

C2

http://93.115.21.45/gtaddress

Targets

    • Target

      91791f8c459f32dc9bf6ec9f7ee157e322b252bc74b1142705dcc74fe8eced7e

    • Size

      62KB

    • MD5

      e538190af9ed2ee602d3cbbe25fd1d78

    • SHA1

      9649f68d1de493b0f17d93b33c2e6bd0ff149e1e

    • SHA256

      91791f8c459f32dc9bf6ec9f7ee157e322b252bc74b1142705dcc74fe8eced7e

    • SHA512

      99b29ef2c068da8d0d50927463257ae1e90b30dab4114af3c5300084b2a6bbdc1d8b67bc9e3cd6d8bd3320c56bb255f7de3a9f60363f2bc0935603e8929eb99b

    • SSDEEP

      768:eUcljbdbaduiSpAmHGHuGFOChjPpcPO2hbdtVWfCoJAvVfjgK+v1Pshc5HFe0jwJ:ABdb1iMASmICZptCX5jRUGgjjvI10w

    Score
    10/10
    netdookaloaderpersistencerat

    • NetDooka

      NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.

      loaderratnetdooka

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Checks for any installed AV software in registry

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Privilege Escalation

New Service

1
T1050

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Security Software Discovery

1
T1063

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks