f26c9ffa3f9ba26a2403a8bf8949f88d7988482a3b7e2270f1e488ffc1df1886 | Triage

Sharing

General

Target

f26c9ffa3f9ba26a2403a8bf8949f88d7988482a3b7e2270f1e488ffc1df1886
Size

136KB
Sample

221029-krjv6aaebm
MD5

fb9e829aa297d5563b52bd4c23cea20f
SHA1

507722663b4c12ea7749b50fe59bc53b0fbc74a1
SHA256

f26c9ffa3f9ba26a2403a8bf8949f88d7988482a3b7e2270f1e488ffc1df1886
SHA512

cd97a65902bf92da9a3552a0292a77fb1e517ea2c607333aa505e47a11227c3224a50a5a529af8c15b84dfe9b3e630bc8a02527c25dc3557da8bb0d9b12601ae
SSDEEP

3072:4HXJr2sw7dtCkGdDYjWL1/jfAv6z1GUOH1wSMBGEbBsM27Pf:4HXh2sw7dtCkdwXz1G3HbB7

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  f26c9ffa3f9ba26a2403a8bf8949f88d7988482a3b7e2270f1e488ffc1df1886
- Size
  
  136KB
- MD5
  
  fb9e829aa297d5563b52bd4c23cea20f
- SHA1
  
  507722663b4c12ea7749b50fe59bc53b0fbc74a1
- SHA256
  
  f26c9ffa3f9ba26a2403a8bf8949f88d7988482a3b7e2270f1e488ffc1df1886
- SHA512
  
  cd97a65902bf92da9a3552a0292a77fb1e517ea2c607333aa505e47a11227c3224a50a5a529af8c15b84dfe9b3e630bc8a02527c25dc3557da8bb0d9b12601ae
- SSDEEP
  
  3072:4HXJr2sw7dtCkGdDYjWL1/jfAv6z1GUOH1wSMBGEbBsM27Pf:4HXh2sw7dtCkdwXz1G3HbB7
Score

10^/10

evasion persistence trojan
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan