Overview

overview

10

Static

static

10

qq仙灵�...��.exe

windows7-x64

1

qq仙灵�...��.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d3af1362807235c0679706c716675fedcd636b5a6c73113576bcc96829374ca

  • Size

    96KB

  • Sample

    221124-q317gagf63

  • MD5

    e7e83293d1ce8cf1665d28d3b519a630

  • SHA1

    0fc7fa0fb0a89d4e93393c5811b266697a0af2ea

  • SHA256

    4d3af1362807235c0679706c716675fedcd636b5a6c73113576bcc96829374ca

  • SHA512

    749f23800d38c06e6f3ce1fc2f6838ae311fcd9d76aa8648affe4a723c13631cf6d2529869369b616c736cf64098a1fbc5b4ec10ad8cfc0f9ad050076cb092b3

  • SSDEEP

    3072:9aq38SKv58Y3EGc/V8Ruqbbemhbn1bJ3il6+TR1cPd:97sF3ut3ybxUt9+Pd

Score
10/10
blackmoonpersistence

Malware Config

Targets

    • Target

      qq仙灵按键精灵.exe

    • Size

      252KB

    • MD5

      95bd21e090d619be1688fb893db3cea1

    • SHA1

      51ebb2b8e54305ecdff2b700d3091dc103da00e7

    • SHA256

      fd252b6504ee55166c98f403dd12959ef34b9d8834e43e807bd70e717c61b9ac

    • SHA512

      93aaa77eb0d295d7c362bb94bae1a0a570430e5b9a4dfff24cf03477274cb93445cdb4f4f0af72af400ac26eccdbfc392aa7dbf0518dd1d4bcd428c684408589

    • SSDEEP

      3072:Nr9KKtUStQJeWIaidfO5+DHkSu0iyhb3xfBTdWISictNJKsEiuBWdWZ:NQKtUoOeWIai9DzM07nx6ijTaY

    Score
    6/10
    persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks