637b44ef49d87e54409e7b13a785969d8865a0b5a4ca1a2f1178e83b7913a18c | Triage

Sharing

General

Target

637b44ef49d87e54409e7b13a785969d8865a0b5a4ca1a2f1178e83b7913a18c
Size

238KB
Sample

221123-rft1bage52
MD5

174a0920f66c78f19d2eb61fed94bf8c
SHA1

7bca7aecf98151c63defaedd5911cad261ff860d
SHA256

637b44ef49d87e54409e7b13a785969d8865a0b5a4ca1a2f1178e83b7913a18c
SHA512

72020b2e653881b1afa3a1464d1c7f1623f475f7bfaaac517e008a9574daa19804e668c07d4e10dd3fff8463da92dd1da5643815c73980ca324dcf9d65dee0e4
SSDEEP

3072:lt5y3I0xY1ECtsY41XyGaALHPJ3XXbCDh2FmEhpedREm0xnqjiwlIrGhUwPp:pgTzCt/4OAB3nbCN2cSMbEm0xnqWN4Uw

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  637b44ef49d87e54409e7b13a785969d8865a0b5a4ca1a2f1178e83b7913a18c
- Size
  
  238KB
- MD5
  
  174a0920f66c78f19d2eb61fed94bf8c
- SHA1
  
  7bca7aecf98151c63defaedd5911cad261ff860d
- SHA256
  
  637b44ef49d87e54409e7b13a785969d8865a0b5a4ca1a2f1178e83b7913a18c
- SHA512
  
  72020b2e653881b1afa3a1464d1c7f1623f475f7bfaaac517e008a9574daa19804e668c07d4e10dd3fff8463da92dd1da5643815c73980ca324dcf9d65dee0e4
- SSDEEP
  
  3072:lt5y3I0xY1ECtsY41XyGaALHPJ3XXbCDh2FmEhpedREm0xnqjiwlIrGhUwPp:pgTzCt/4OAB3nbCN2cSMbEm0xnqWN4Uw
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2