26caaa36ff182995fdfa329b1b9413c04f60e279d99f19a691a75b32244eba48 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

26caaa36ff182995fdfa329b1b9413c04f60e279d99f19a691a75b32244eba48
Size

132KB
Sample

220919-raenfafffr
MD5

23926ca17880d00dad32df4a41df0644
SHA1

172b6f7114854e31f6f921678d177f419e57a549
SHA256

26caaa36ff182995fdfa329b1b9413c04f60e279d99f19a691a75b32244eba48
SHA512

79a72db914c8cf82888cd0034431278aeddb3a865675048853d176c83774e559927f49318fb461a867eb4380537692a73d64669b84b8ff29dfca780c899871c7
SSDEEP

3072:YqPg6BfNjU07DMr9ty3ySaaFgfO1YyZUyEEP:HPg6Vu0PSGySRkyZ9

Score

8^/10

evasion persistence

Malware Config

Targets

- Target
  
  26caaa36ff182995fdfa329b1b9413c04f60e279d99f19a691a75b32244eba48
- Size
  
  132KB
- MD5
  
  23926ca17880d00dad32df4a41df0644
- SHA1
  
  172b6f7114854e31f6f921678d177f419e57a549
- SHA256
  
  26caaa36ff182995fdfa329b1b9413c04f60e279d99f19a691a75b32244eba48
- SHA512
  
  79a72db914c8cf82888cd0034431278aeddb3a865675048853d176c83774e559927f49318fb461a867eb4380537692a73d64669b84b8ff29dfca780c899871c7
- SSDEEP
  
  3072:YqPg6BfNjU07DMr9ty3ySaaFgfO1YyZUyEEP:HPg6Vu0PSGySRkyZ9
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionpersistence