Overview

overview

10

Static

static

6bd6968e8b...8b.exe

windows7-x64

10

6bd6968e8b...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6bd6968e8b24043ce70a37a9deb33bf0066a5317831e6db2b2e989bef7aabc8b

  • Size

    1024KB

  • Sample

    221124-ey3zqaca71

  • MD5

    4ff15c525dbc027ee83c96bd5b19a0dd

  • SHA1

    a6a10bc643528c5125a9e4353155aa26ecee67c2

  • SHA256

    6bd6968e8b24043ce70a37a9deb33bf0066a5317831e6db2b2e989bef7aabc8b

  • SHA512

    17458e3a4c0e0bc4960a6d872f122ae66266c15b068fb249bee0d54ee4efd8690c0b282650ccb851c606ae54d80cae181ca50d1f37f338b3fcd90c4cc385cc6c

  • SSDEEP

    384:0sLbEt/IpzekptrZ2rMgSVSZTKEctnt8moqAP6hsbinvLT9npzl+1Pedn57f1kzg:b4zWrkYVSZTKEctEqPscpMllux7Hh

Score
10/10
persistence

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    duiker10

Targets

    • Target

      6bd6968e8b24043ce70a37a9deb33bf0066a5317831e6db2b2e989bef7aabc8b

    • Size

      1024KB

    • MD5

      4ff15c525dbc027ee83c96bd5b19a0dd

    • SHA1

      a6a10bc643528c5125a9e4353155aa26ecee67c2

    • SHA256

      6bd6968e8b24043ce70a37a9deb33bf0066a5317831e6db2b2e989bef7aabc8b

    • SHA512

      17458e3a4c0e0bc4960a6d872f122ae66266c15b068fb249bee0d54ee4efd8690c0b282650ccb851c606ae54d80cae181ca50d1f37f338b3fcd90c4cc385cc6c

    • SSDEEP

      384:0sLbEt/IpzekptrZ2rMgSVSZTKEctnt8moqAP6hsbinvLT9npzl+1Pedn57f1kzg:b4zWrkYVSZTKEctEqPscpMllux7Hh

    Score
    10/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks