c176a2bf24efba11b4552498fa90e5d51dfb1edd4e4110f21ebd9a43efdc13f4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c176a2bf24efba11b4552498fa90e5d51dfb1edd4e4110f21ebd9a43efdc13f4
Size

2.4MB
Sample

221206-b2f3ksad5s
MD5

6903beabee43994a57618da804c23c6e
SHA1

09015a9adbf1b4f1d2ec8eb1626deb982e7944c7
SHA256

c176a2bf24efba11b4552498fa90e5d51dfb1edd4e4110f21ebd9a43efdc13f4
SHA512

fdcc6a38dc9521616df082122e90381d7225cc0d3797b76909e2a6e444099ed3b1c42c99f21640f8fe7bbd2fefd358c9b3134444e6bb4824db29681347a6ed96
SSDEEP

1536:IWYNxXhoNwWEyHxuEYZLdXTDWL20wYEAOvZFXIReDGTBmE:NQfgfFsRdXfWidAORqeDgBL

Score

10^/10

evasion trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
bauza123

Targets

- Target
  
  c176a2bf24efba11b4552498fa90e5d51dfb1edd4e4110f21ebd9a43efdc13f4
- Size
  
  2.4MB
- MD5
  
  6903beabee43994a57618da804c23c6e
- SHA1
  
  09015a9adbf1b4f1d2ec8eb1626deb982e7944c7
- SHA256
  
  c176a2bf24efba11b4552498fa90e5d51dfb1edd4e4110f21ebd9a43efdc13f4
- SHA512
  
  fdcc6a38dc9521616df082122e90381d7225cc0d3797b76909e2a6e444099ed3b1c42c99f21640f8fe7bbd2fefd358c9b3134444e6bb4824db29681347a6ed96
- SSDEEP
  
  1536:IWYNxXhoNwWEyHxuEYZLdXTDWL20wYEAOvZFXIReDGTBmE:NQfgfFsRdXfWidAORqeDgBL
Score

10^/10

evasion trojan
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Drops file in Drivers directory
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2