c4be691276e369f6128ee4aab10e8fcaeaeb34780acd78aba5d6f4d54ad0b881 | Triage

Sharing

General

Target

c4be691276e369f6128ee4aab10e8fcaeaeb34780acd78aba5d6f4d54ad0b881
Size

18KB
Sample

221206-xnsp4seb43
MD5

326bf797eeb26bd9bbf54ecdbdd66d4d
SHA1

80e9be60f5af3dc1c1b4eaffd16917dd74bebafc
SHA256

c4be691276e369f6128ee4aab10e8fcaeaeb34780acd78aba5d6f4d54ad0b881
SHA512

d9454aa6684b89fcc98d3da50881996da79c1ee33364e083e074d0c292ed111fd98d2edf7b0fde28c562ee5f64355515f2839c907592deca1e36d06e6b7101cd
SSDEEP

384:sRSKD0/sTMuJSjXGOAcXptDcqX/NvdtPWknbh0CJyFVY98RfP7Kh09Qo:sRSKD02pUGOAspRcy/NvfPWkbh0CmVYg

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  c4be691276e369f6128ee4aab10e8fcaeaeb34780acd78aba5d6f4d54ad0b881
- Size
  
  18KB
- MD5
  
  326bf797eeb26bd9bbf54ecdbdd66d4d
- SHA1
  
  80e9be60f5af3dc1c1b4eaffd16917dd74bebafc
- SHA256
  
  c4be691276e369f6128ee4aab10e8fcaeaeb34780acd78aba5d6f4d54ad0b881
- SHA512
  
  d9454aa6684b89fcc98d3da50881996da79c1ee33364e083e074d0c292ed111fd98d2edf7b0fde28c562ee5f64355515f2839c907592deca1e36d06e6b7101cd
- SSDEEP
  
  384:sRSKD0/sTMuJSjXGOAcXptDcqX/NvdtPWknbh0CJyFVY98RfP7Kh09Qo:sRSKD02pUGOAspRcy/NvfPWkbh0CmVYg
Score

10^/10

evasion trojan
- Modifies firewall policy service
  evasion
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2