28de16356916b02237be26b7e219cc2b68580be4eb5cd77f2d44eeca0fbee17b | Triage

Sharing

General

Target

28de16356916b02237be26b7e219cc2b68580be4eb5cd77f2d44eeca0fbee17b
Size

384KB
Sample

220919-aftacagbe6
MD5

cb0a0d1153f2889e86c8f1c9cb0f9c2e
SHA1

0078660c41809f267afabcb1ca2859d0c51bc999
SHA256

28de16356916b02237be26b7e219cc2b68580be4eb5cd77f2d44eeca0fbee17b
SHA512

20a6758189bc8e591f07cd0a012fb1334b07121cb4722e00e3fbbe5efde69b1a8bb5ad6c420d9c18bdbae227eb83b07f324154c86ac70b911e93182e1c7778e5
SSDEEP

6144:RdKh+QOMY+avjB85bZRRynJmeu7Jy3ySR692kIyADjOhpwOcn1UiEPVRxJxJ2RC8:vKh+QO1Lv4RKoe+Jy3ySw9u7UKORJxBu

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  28de16356916b02237be26b7e219cc2b68580be4eb5cd77f2d44eeca0fbee17b
- Size
  
  384KB
- MD5
  
  cb0a0d1153f2889e86c8f1c9cb0f9c2e
- SHA1
  
  0078660c41809f267afabcb1ca2859d0c51bc999
- SHA256
  
  28de16356916b02237be26b7e219cc2b68580be4eb5cd77f2d44eeca0fbee17b
- SHA512
  
  20a6758189bc8e591f07cd0a012fb1334b07121cb4722e00e3fbbe5efde69b1a8bb5ad6c420d9c18bdbae227eb83b07f324154c86ac70b911e93182e1c7778e5
- SSDEEP
  
  6144:RdKh+QOMY+avjB85bZRRynJmeu7Jy3ySR692kIyADjOhpwOcn1UiEPVRxJxJ2RC8:vKh+QO1Lv4RKoe+Jy3ySw9u7UKORJxBu
Score

10^/10

evasion persistence trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables taskbar notifications via registry modification
  evasion
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2