df0a4e83cbab7d9056a55e8d4e3669a7f2035a0ff1b8b2720cb7840191ece5cd | Triage

Sharing

General

Target

df0a4e83cbab7d9056a55e8d4e3669a7f2035a0ff1b8b2720cb7840191ece5cd
Size

119KB
Sample

221125-29r3xsha4w
MD5

0206d396524ffaa64103151c820ddea6
SHA1

9ba5346a908713f15740370d5e82b393aad54fed
SHA256

df0a4e83cbab7d9056a55e8d4e3669a7f2035a0ff1b8b2720cb7840191ece5cd
SHA512

ffc2c5c0fab6ef6cb5efecf0d22831aabf9e0d86fd1b02b0451e7e5e3fde6017fd17fb0a74b42382e4d8dad8221d30e2bd7847def7a87c9db26daf1ea5beadf0
SSDEEP

3072:dwrhOUULAgG01X1cRxMdiQfngFz9PRtyWXQBaNWjJA:dwrhOZo01aWfmhLX4jG

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  df0a4e83cbab7d9056a55e8d4e3669a7f2035a0ff1b8b2720cb7840191ece5cd
- Size
  
  119KB
- MD5
  
  0206d396524ffaa64103151c820ddea6
- SHA1
  
  9ba5346a908713f15740370d5e82b393aad54fed
- SHA256
  
  df0a4e83cbab7d9056a55e8d4e3669a7f2035a0ff1b8b2720cb7840191ece5cd
- SHA512
  
  ffc2c5c0fab6ef6cb5efecf0d22831aabf9e0d86fd1b02b0451e7e5e3fde6017fd17fb0a74b42382e4d8dad8221d30e2bd7847def7a87c9db26daf1ea5beadf0
- SSDEEP
  
  3072:dwrhOUULAgG01X1cRxMdiQfngFz9PRtyWXQBaNWjJA:dwrhOZo01aWfmhLX4jG
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2