Overview

overview

10

Static

static

bf919a08df...88.exe

windows7-x64

10

bf919a08df...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf919a08dfebf6a7eabdebd2178a2fe01134f6eb78ffc6277bdc61d059509d88

  • Size

    212KB

  • Sample

    221124-yk4tmsaa51

  • MD5

    daff4a4d7750623f73c8dd146709d26a

  • SHA1

    2ea2c1e751471991f00c5d46f028ef449932c605

  • SHA256

    bf919a08dfebf6a7eabdebd2178a2fe01134f6eb78ffc6277bdc61d059509d88

  • SHA512

    d9fc3ca2e268b9542297269c4d0bfe6f5475e7c1b49ed53387812b2d03920316f1361c550bee8aa61f688520b732814c9bf900165b03def393ad3b5f8827ae8a

  • SSDEEP

    3072:0fjboxnOCPJTY3N0GGC5VugWyCEbC1Mhh7ZvtLH+AASc:cs5Y90gNzbCqn7q

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      bf919a08dfebf6a7eabdebd2178a2fe01134f6eb78ffc6277bdc61d059509d88

    • Size

      212KB

    • MD5

      daff4a4d7750623f73c8dd146709d26a

    • SHA1

      2ea2c1e751471991f00c5d46f028ef449932c605

    • SHA256

      bf919a08dfebf6a7eabdebd2178a2fe01134f6eb78ffc6277bdc61d059509d88

    • SHA512

      d9fc3ca2e268b9542297269c4d0bfe6f5475e7c1b49ed53387812b2d03920316f1361c550bee8aa61f688520b732814c9bf900165b03def393ad3b5f8827ae8a

    • SSDEEP

      3072:0fjboxnOCPJTY3N0GGC5VugWyCEbC1Mhh7ZvtLH+AASc:cs5Y90gNzbCqn7q

    Score
    10/10
    evasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Disables taskbar notifications via registry modification

      evasion

    • Deletes itself

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks