Overview

overview

9

Static

static

cb8f9dd40d...88.exe

windows7-x64

9

cb8f9dd40d...88.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb8f9dd40dd8d76a954a2c9343c9432650c12e02d0f8bf161dc6761a8ab98c88

  • Size

    1.1MB

  • Sample

    221123-k2byasdc91

  • MD5

    3b00da7a9d17760394fc5a8702df4b9d

  • SHA1

    71bfd9b5e0183996c96de3007101ea9509eac014

  • SHA256

    cb8f9dd40dd8d76a954a2c9343c9432650c12e02d0f8bf161dc6761a8ab98c88

  • SHA512

    ab4561a57d1138971de1294fb2aa4db5d16aa70b9e872d299442f231912d3fc0971ae80ca51d096ee75eaee92092d9721bcff86930d4dd75aeb24e970ac76e52

  • SSDEEP

    24576:oAtPMIY2WnP9lRTV8xKLQX9DZm1GR27M283ZmWe2UXxWFu8:ovzP9HpMiQtZjR27M33AWgi

Score
9/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      cb8f9dd40dd8d76a954a2c9343c9432650c12e02d0f8bf161dc6761a8ab98c88

    • Size

      1.1MB

    • MD5

      3b00da7a9d17760394fc5a8702df4b9d

    • SHA1

      71bfd9b5e0183996c96de3007101ea9509eac014

    • SHA256

      cb8f9dd40dd8d76a954a2c9343c9432650c12e02d0f8bf161dc6761a8ab98c88

    • SHA512

      ab4561a57d1138971de1294fb2aa4db5d16aa70b9e872d299442f231912d3fc0971ae80ca51d096ee75eaee92092d9721bcff86930d4dd75aeb24e970ac76e52

    • SSDEEP

      24576:oAtPMIY2WnP9lRTV8xKLQX9DZm1GR27M283ZmWe2UXxWFu8:ovzP9HpMiQtZjR27M33AWgi

    Score
    9/10
    discoveryevasionpersistence

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Enumerates VirtualBox registry keys

      evasion

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Software Discovery

1
T1518

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks