36396d00f2299401f222a709d1a76139a2b610e4d2d515b53f4c8da09a279eea | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36396d00f2299401f222a709d1a76139a2b610e4d2d515b53f4c8da09a279eea
Size

289KB
Sample

221027-f2mbtaahe8
MD5

767c9c5ee1999ad55cc0fca3f0d2c6b5
SHA1

8abbe6d2b9f3f419a5fa3abc4c93104d95b2a6ff
SHA256

36396d00f2299401f222a709d1a76139a2b610e4d2d515b53f4c8da09a279eea
SHA512

91722aab833cade1f64059f3ab2be90181fe0406c6f9d76edc8a80e571bf9eaaca4ba9489a96ddd6c315ea34f29fe93839885f1d9da1892fa8a790728f0a99dd
SSDEEP

6144:tZ1EGlekBKDzvUXAvDGSu4Hh0L+aNBJyDRWNpQfZXVhbGhHd:b17lhg/DGSukh0L+9WfsZj4d

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  36396d00f2299401f222a709d1a76139a2b610e4d2d515b53f4c8da09a279eea
- Size
  
  289KB
- MD5
  
  767c9c5ee1999ad55cc0fca3f0d2c6b5
- SHA1
  
  8abbe6d2b9f3f419a5fa3abc4c93104d95b2a6ff
- SHA256
  
  36396d00f2299401f222a709d1a76139a2b610e4d2d515b53f4c8da09a279eea
- SHA512
  
  91722aab833cade1f64059f3ab2be90181fe0406c6f9d76edc8a80e571bf9eaaca4ba9489a96ddd6c315ea34f29fe93839885f1d9da1892fa8a790728f0a99dd
- SSDEEP
  
  6144:tZ1EGlekBKDzvUXAvDGSu4Hh0L+aNBJyDRWNpQfZXVhbGhHd:b17lhg/DGSukh0L+9WfsZj4d
Score

10^/10

evasion persistence trojan
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops startup file
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan