cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a
Size

152KB
Sample

221030-gjm13aeee3
MD5

a2b85a6ffe8860bd14e22239d6790133
SHA1

17d4bb76001f745d034e255264427792267f4ca9
SHA256

cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a
SHA512

7faf4f111896a01d20f6c81aca974ad2c28531569b25adaa33ff30c0ba8d1c445146b8a76aec24b7e623f25b994ba3de6d24a61888a76adeb603ddca6825cf6b
SSDEEP

1536:D3wo0rK5iX/3PjPozbSdHjWTMHPf+3AAuOsIdCH/NYJXLhA5Eq26g4SEx857Zp4y:D3wnrK5i371O3jO5i6g4SESBQTqj5

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a
- Size
  
  152KB
- MD5
  
  a2b85a6ffe8860bd14e22239d6790133
- SHA1
  
  17d4bb76001f745d034e255264427792267f4ca9
- SHA256
  
  cda0cb962af2a61d7a0847b7c7e8a7d083e86c1a52d1d1ab4a8a472c80a9111a
- SHA512
  
  7faf4f111896a01d20f6c81aca974ad2c28531569b25adaa33ff30c0ba8d1c445146b8a76aec24b7e623f25b994ba3de6d24a61888a76adeb603ddca6825cf6b
- SSDEEP
  
  1536:D3wo0rK5iX/3PjPozbSdHjWTMHPf+3AAuOsIdCH/NYJXLhA5Eq26g4SEx857Zp4y:D3wnrK5i371O3jO5i6g4SESBQTqj5
Score

10^/10

evasion persistence trojan
- UAC bypass
  evasion trojan
- Modifies AppInit DLL entries
  persistence
- Deletes itself
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan