Overview

overview

10

Static

static

trojan-rem...79.exe

windows7-x64

10

trojan-rem...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    trojan-remover-6-9-5-build-2979.exe

  • Size

    13.9MB

  • Sample

    221105-1zcptaaaa6

  • MD5

    d9b2800a8a86996172ec18f1cb48786a

  • SHA1

    d2c558564f0f322c0647b36d82d1e98921e58587

  • SHA256

    4926c75e330b65f38f41386b42a402298672fa466e2a26f65d8420974c39fda0

  • SHA512

    391f18d5127327499cb537b4e6b92011624f836e48c0f35c1954a8897fbb828ed5482fbcf3f1aba3549e39cca5fd22a499876c4a81b8ee45621304fa0d3801df

  • SSDEEP

    393216:q3Hft0T7yG9QKWsKPrTYyi2JwEivFQrzPaUwL:kl0PgJsekcivSrzPwL

Score
10/10
discoverypersistence

Malware Config

Targets

    • Target

      trojan-remover-6-9-5-build-2979.exe

    • Size

      13.9MB

    • MD5

      d9b2800a8a86996172ec18f1cb48786a

    • SHA1

      d2c558564f0f322c0647b36d82d1e98921e58587

    • SHA256

      4926c75e330b65f38f41386b42a402298672fa466e2a26f65d8420974c39fda0

    • SHA512

      391f18d5127327499cb537b4e6b92011624f836e48c0f35c1954a8897fbb828ed5482fbcf3f1aba3549e39cca5fd22a499876c4a81b8ee45621304fa0d3801df

    • SSDEEP

      393216:q3Hft0T7yG9QKWsKPrTYyi2JwEivFQrzPaUwL:kl0PgJsekcivSrzPwL

    Score
    10/10
    discoverypersistence

    • Modifies system executable filetype association

      persistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks