Overview

overview

9

Static

static

242b5a2a41...ba.exe

windows7-x64

9

242b5a2a41...ba.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    242b5a2a411b654389034e96e0907a7e6a531eb2d1c3a711561c3a51b86945ba

  • Size

    598KB

  • Sample

    221126-2pr77aec8x

  • MD5

    fed712f05608691dbdfd0a693fb45e4d

  • SHA1

    420b2b69b05f387326e456020d43b3efa38e1e97

  • SHA256

    242b5a2a411b654389034e96e0907a7e6a531eb2d1c3a711561c3a51b86945ba

  • SHA512

    8b2adb6d4ef9f939782edf82c313714a51c64652fa7c03d0392d89cea1ce973a8d5451e62c37bad3b6403434cee853254f48d69317591da0a031526db7000e7a

  • SSDEEP

    6144:Tf3nSK1ae5HXQPFfH7d97qPU2sXUtnEPXs8SrTiJHltUnV6F/Q649nv9Eymunv+k:TfCK1aSiFesN6iV7VQ6iiMmt+1hZjV9

Score
9/10
discoveryevasionpersistence

Malware Config

Targets

    • Target

      242b5a2a411b654389034e96e0907a7e6a531eb2d1c3a711561c3a51b86945ba

    • Size

      598KB

    • MD5

      fed712f05608691dbdfd0a693fb45e4d

    • SHA1

      420b2b69b05f387326e456020d43b3efa38e1e97

    • SHA256

      242b5a2a411b654389034e96e0907a7e6a531eb2d1c3a711561c3a51b86945ba

    • SHA512

      8b2adb6d4ef9f939782edf82c313714a51c64652fa7c03d0392d89cea1ce973a8d5451e62c37bad3b6403434cee853254f48d69317591da0a031526db7000e7a

    • SSDEEP

      6144:Tf3nSK1ae5HXQPFfH7d97qPU2sXUtnEPXs8SrTiJHltUnV6F/Q649nv9Eymunv+k:TfCK1aSiFesN6iV7VQ6iiMmt+1hZjV9

    Score
    9/10
    discoveryevasionpersistence

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Enumerates VirtualBox registry keys

      evasion

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Software Discovery

1
T1518

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks