af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed
Size

681KB
Sample

221204-pmwflshc37
MD5

1e61eb848786b4d2285da8cf0bdb2bfc
SHA1

8045da8ab2c14da0ba724592f9046bec2d3cc1d0
SHA256

af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed
SHA512

3f94345f471d77ec85abe0dc5b63192ddf539a72d9bd90170d9293259132e333a7b8dfdbee3a4ab2bacb691e94a932d17efbafb6cbc9cc6dcb72e1e946b9c2fb
SSDEEP

12288:xgM0xX/tdDZxZi/WARQQfvZeBG72lD/y0CIhPUW2HwuMg4IZXfO34NENPRH8V97X:xgdNi/WhkRn72B/y0CsUwcBO3oEN5H+X

Score

8^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed
- Size
  
  681KB
- MD5
  
  1e61eb848786b4d2285da8cf0bdb2bfc
- SHA1
  
  8045da8ab2c14da0ba724592f9046bec2d3cc1d0
- SHA256
  
  af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed
- SHA512
  
  3f94345f471d77ec85abe0dc5b63192ddf539a72d9bd90170d9293259132e333a7b8dfdbee3a4ab2bacb691e94a932d17efbafb6cbc9cc6dcb72e1e946b9c2fb
- SSDEEP
  
  12288:xgM0xX/tdDZxZi/WARQQfvZeBG72lD/y0CIhPUW2HwuMg4IZXfO34NENPRH8V97X:xgdNi/WhkRn72B/y0CsUwcBO3oEN5H+X
Score

8^/10

discovery evasion persistence trojan
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan