Overview

overview

7

Static

static

volksbank_...02.exe

windows7-x64

7

volksbank_...02.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c4bf79351e65bdee9aa152feb145884c936b8bfbc407b4d23e73d3b8cd51b4e6

  • Size

    126KB

  • Sample

    221124-e889gscg8x

  • MD5

    24dbb31f4f36937b1793da4fefcb3b9f

  • SHA1

    9c9bd6dca418d4824392f36c9fcfc65698758811

  • SHA256

    c4bf79351e65bdee9aa152feb145884c936b8bfbc407b4d23e73d3b8cd51b4e6

  • SHA512

    406b13bc038efc73dd838abd56a92887a39e7e1bc4f0cf4dade793fee6dfe9dcc5945276098ce8841ce31ca592a202a4cb3e87528dfc3a320e24f25c12419e02

  • SSDEEP

    3072:3wQLmZuIPLyr7blrQStd3jUQdW6CTHeOO16ogZrssU4nYaI0y7x:3J+Ly/prQqz1QTE6dZrqaYf5x

Score
7/10
persistence

Malware Config

Targets

    • Target

      volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe

    • Size

      176KB

    • MD5

      72fa9e74d45dda3085eafb77eb497b1a

    • SHA1

      536b13842b5c0ff70177c0c4fd80ce1ff892a15e

    • SHA256

      7a4e899fc05973c8d3fb596750fc1b848daad7cd2cc6cee2c8fb44977e39c45d

    • SHA512

      f5313d65269010038072e25e2ca6859a914a5db31815ee662def861a7809f6098fd25dc68c142efd5e0929e420221393e73aa77fbcd4ba8af4da95a73329737c

    • SSDEEP

      3072:zQnHNmI+yMkJR+Omz1C+cSQStd3jUQdW6OTHeOO16ogZrssN6wc+ga0Mhze:zwHBRtJ2BC+Cqz14TE6dZr5PQ

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks