426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139 | Triage

Sharing

General

Target

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139
Size

492KB
Sample

221123-w58bfsdh68
MD5

5073ed321d5785152d161af3a3764d8f
SHA1

213d24b9017a309f0f3a25023c0299e4d44ab0bb
SHA256

426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139
SHA512

64bd8aba777de85ad5488cc5b0ae412a38c36b811909318557659a4f9e7910247b6aab13d33da8e55a213780cea807071cb4fb8076645b2dcc21105b928ab8bb
SSDEEP

768:u4mLYD9j5l0SzffhROPMDpTrCS6fvImSrVKRt3TGgJHWf5u9d3vo+VWQs7xO2inh:dmD7tej+v

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139
- Size
  
  492KB
- MD5
  
  5073ed321d5785152d161af3a3764d8f
- SHA1
  
  213d24b9017a309f0f3a25023c0299e4d44ab0bb
- SHA256
  
  426ce16be29946ad788fd5134d854296cc80d8f34d4334e1aba076da397ba139
- SHA512
  
  64bd8aba777de85ad5488cc5b0ae412a38c36b811909318557659a4f9e7910247b6aab13d33da8e55a213780cea807071cb4fb8076645b2dcc21105b928ab8bb
- SSDEEP
  
  768:u4mLYD9j5l0SzffhROPMDpTrCS6fvImSrVKRt3TGgJHWf5u9d3vo+VWQs7xO2inh:dmD7tej+v
Score

10^/10

evasion trojan
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2