946d56aa46be6b545ea92d8ce35190579d72b1f6165bc11a6c820ee5dc7d33dc | Triage

Sharing

General

Target

946d56aa46be6b545ea92d8ce35190579d72b1f6165bc11a6c820ee5dc7d33dc
Size

326KB
Sample

221126-ky52zaff55
MD5

57c64912e6ce05cbb0550aab2dc9bed7
SHA1

5026faead451e4324ed150f5ac874225626e551b
SHA256

946d56aa46be6b545ea92d8ce35190579d72b1f6165bc11a6c820ee5dc7d33dc
SHA512

0f4247b5de7e0b9ac1a78e82e4b27618e297d90c4a2782b34a64b1321ad6cfe3f3239710c07c9f58d4f00f1823f5cc1dd0d8628ed62f1706a8d255d44aa0cffe
SSDEEP

6144:yz+92mhAMJ/cPl3iZM+OS/ku0SOfZcfVKYLXCeT6tZbQG/fuSuNUqBBJWphERnd:yK2mhAMJ/cPlL+OSsu0/hcfVKYLXCeTD

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  946d56aa46be6b545ea92d8ce35190579d72b1f6165bc11a6c820ee5dc7d33dc
- Size
  
  326KB
- MD5
  
  57c64912e6ce05cbb0550aab2dc9bed7
- SHA1
  
  5026faead451e4324ed150f5ac874225626e551b
- SHA256
  
  946d56aa46be6b545ea92d8ce35190579d72b1f6165bc11a6c820ee5dc7d33dc
- SHA512
  
  0f4247b5de7e0b9ac1a78e82e4b27618e297d90c4a2782b34a64b1321ad6cfe3f3239710c07c9f58d4f00f1823f5cc1dd0d8628ed62f1706a8d255d44aa0cffe
- SSDEEP
  
  6144:yz+92mhAMJ/cPl3iZM+OS/ku0SOfZcfVKYLXCeT6tZbQG/fuSuNUqBBJWphERnd:yK2mhAMJ/cPlL+OSsu0/hcfVKYLXCeTD
Score

10^/10

evasion persistence trojan
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan