Overview

overview

9

Static

static

8f2a103c47...34.exe

windows7-x64

9

8f2a103c47...34.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f2a103c47de22f189b5f216ace9b674cfaef41971ea37480a9a0f0c6dbd5a34

  • Size

    710KB

  • Sample

    221125-x7w7msdb6y

  • MD5

    da774e8e237e52ddaebd4e6a61439780

  • SHA1

    5293332a8516b193a562bf29bf189348da351e1a

  • SHA256

    8f2a103c47de22f189b5f216ace9b674cfaef41971ea37480a9a0f0c6dbd5a34

  • SHA512

    c31275ae44f6af4c0f9977250b0d50ddb491fe8b6614610dba730079d99a0d99e72871dff7524e6a25e6b5022632cd695d20f5ab48fda5ce0a9cf22af6eb7d64

  • SSDEEP

    12288:IfKcPm/4SCrAZ4Qz0uQSf23mlYzeH3LiteeN67uJTHLdEStAvzTaMJyDh0xhA:IfKcNrAZhzXvH7iteeU7YrdrtgzTaMJM

Score
9/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      8f2a103c47de22f189b5f216ace9b674cfaef41971ea37480a9a0f0c6dbd5a34

    • Size

      710KB

    • MD5

      da774e8e237e52ddaebd4e6a61439780

    • SHA1

      5293332a8516b193a562bf29bf189348da351e1a

    • SHA256

      8f2a103c47de22f189b5f216ace9b674cfaef41971ea37480a9a0f0c6dbd5a34

    • SHA512

      c31275ae44f6af4c0f9977250b0d50ddb491fe8b6614610dba730079d99a0d99e72871dff7524e6a25e6b5022632cd695d20f5ab48fda5ce0a9cf22af6eb7d64

    • SSDEEP

      12288:IfKcPm/4SCrAZ4Qz0uQSf23mlYzeH3LiteeN67uJTHLdEStAvzTaMJyDh0xhA:IfKcNrAZhzXvH7iteeU7YrdrtgzTaMJM

    Score
    9/10
    discoveryevasionpersistence

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Enumerates VirtualBox registry keys

      evasion

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Software Discovery

1
T1518

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks