cabf6680d0c0c4f2af98f421db2e11795536208ac1cebcc001671cb04f580e96 | Triage

Sharing

General

Target

cabf6680d0c0c4f2af98f421db2e11795536208ac1cebcc001671cb04f580e96
Size

75KB
Sample

221126-cnj3rahc8t
MD5

1585d0fe2a7ec9f710a016dee24b1e4f
SHA1

6730f34bdf92b11346b1e34e36a7981d8cf55f7e
SHA256

cabf6680d0c0c4f2af98f421db2e11795536208ac1cebcc001671cb04f580e96
SHA512

6c7d085a11bc0e91945896815f403546bafc09af4a0300b7822342a784a6cf81a8c4fad20dd88594625d1b9830081c33745532310c653bd13e5c78cfcd95a4d7
SSDEEP

1536:+TEmpbswZUH3smQaNWT7lw2YrWCwtMfRBhijv9zwIeAAD3:+TEmuLc2QlwYCwRpu

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  cabf6680d0c0c4f2af98f421db2e11795536208ac1cebcc001671cb04f580e96
- Size
  
  75KB
- MD5
  
  1585d0fe2a7ec9f710a016dee24b1e4f
- SHA1
  
  6730f34bdf92b11346b1e34e36a7981d8cf55f7e
- SHA256
  
  cabf6680d0c0c4f2af98f421db2e11795536208ac1cebcc001671cb04f580e96
- SHA512
  
  6c7d085a11bc0e91945896815f403546bafc09af4a0300b7822342a784a6cf81a8c4fad20dd88594625d1b9830081c33745532310c653bd13e5c78cfcd95a4d7
- SSDEEP
  
  1536:+TEmpbswZUH3smQaNWT7lw2YrWCwtMfRBhijv9zwIeAAD3:+TEmuLc2QlwYCwRpu
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2