f1a9a49c6e2fe8da56f738c9ef6436ffbc0c434b7a18a44894d89f35ca83303e | Triage

Sharing

General

Target

f1a9a49c6e2fe8da56f738c9ef6436ffbc0c434b7a18a44894d89f35ca83303e
Size

855KB
Sample

221127-ewlyesda4x
MD5

47b5ac9f2ba842e1891ae3b13cbdf2be
SHA1

520156191c21415ddeeea4a8979d7c612dbb1ba7
SHA256

f1a9a49c6e2fe8da56f738c9ef6436ffbc0c434b7a18a44894d89f35ca83303e
SHA512

5495999276c8d3bee6bb28bf6d352ab784868a9a7b3ff63015625ac7cdb59b61fb77d03c05489957ba300868841667d4a5191f6dca19b890c114e60033ecc133
SSDEEP

12288:wA4/avQs9NBhbYt10XOu6anCCG20pMyiyX4U/a64xfOeMxbwwxPjSO6Y0tQ20Lbm:f4/alNfbYtQH6GCXsEa3GeiwvTpisX

Score

8^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  f1a9a49c6e2fe8da56f738c9ef6436ffbc0c434b7a18a44894d89f35ca83303e
- Size
  
  855KB
- MD5
  
  47b5ac9f2ba842e1891ae3b13cbdf2be
- SHA1
  
  520156191c21415ddeeea4a8979d7c612dbb1ba7
- SHA256
  
  f1a9a49c6e2fe8da56f738c9ef6436ffbc0c434b7a18a44894d89f35ca83303e
- SHA512
  
  5495999276c8d3bee6bb28bf6d352ab784868a9a7b3ff63015625ac7cdb59b61fb77d03c05489957ba300868841667d4a5191f6dca19b890c114e60033ecc133
- SSDEEP
  
  12288:wA4/avQs9NBhbYt10XOu6anCCG20pMyiyX4U/a64xfOeMxbwwxPjSO6Y0tQ20Lbm:f4/alNfbYtQH6GCXsEa3GeiwvTpisX
Score

8^/10

discovery evasion persistence trojan
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan