Overview

overview

9

Static

static

8248bb0fa4...4f.exe

windows7-x64

9

8248bb0fa4...4f.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8248bb0fa47ddb0f73fbeec18641d6e1cb158fa1fb3a7ea4b4a136782f26ac4f

  • Size

    616KB

  • Sample

    221125-jd5p2abc42

  • MD5

    178bbf280192b9838e6c3ceaf05c2543

  • SHA1

    e682e71df1a29ee1ac1f3ae5254e3c9ba8deee9f

  • SHA256

    8248bb0fa47ddb0f73fbeec18641d6e1cb158fa1fb3a7ea4b4a136782f26ac4f

  • SHA512

    b4e8326d42999c506c46468173b885619242e3275b90af5d8b5fe63bb377f9c2b5d925bc8992df622134171617a2fe0aea9f0fa17205b1db090403c5db9786b4

  • SSDEEP

    12288:XX7Wt+2P0iU2sdOPRpl+QmzJ8SuFluK+YDIAnems:bWtbTU2LPWtvuH7D/

Score
9/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      8248bb0fa47ddb0f73fbeec18641d6e1cb158fa1fb3a7ea4b4a136782f26ac4f

    • Size

      616KB

    • MD5

      178bbf280192b9838e6c3ceaf05c2543

    • SHA1

      e682e71df1a29ee1ac1f3ae5254e3c9ba8deee9f

    • SHA256

      8248bb0fa47ddb0f73fbeec18641d6e1cb158fa1fb3a7ea4b4a136782f26ac4f

    • SHA512

      b4e8326d42999c506c46468173b885619242e3275b90af5d8b5fe63bb377f9c2b5d925bc8992df622134171617a2fe0aea9f0fa17205b1db090403c5db9786b4

    • SSDEEP

      12288:XX7Wt+2P0iU2sdOPRpl+QmzJ8SuFluK+YDIAnems:bWtbTU2LPWtvuH7D/

    Score
    9/10
    discoveryevasionpersistence

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Enumerates VirtualBox registry keys

      evasion

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Software Discovery

1
T1518

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks