Overview

overview

10

Static

static

10

sotema_5.txt.exe

windows7-x64

10

sotema_5.txt.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sotema_5.txt.exe

  • Size

    773KB

  • Sample

    230122-28j1xsab49

  • MD5

    51e7f03ae54c977764c32b0dedf0b9ac

  • SHA1

    03cf8e81b1b8a96097c9e3da11f925e7dc6819b7

  • SHA256

    0580678f81e9801e3678c5d4cf1cfe674aa52ce95092e67908d6a7d4192a429b

  • SHA512

    03ea4d2dd652c3fd858c54cf579c410a12c7296acf222ebad57bcfaea33b71fc411122bc35a7b8ff56cb0254e42a6042fbe6efdb47a97ba61fb6ed15c9931661

  • SSDEEP

    24576:Wu/phBzW6ZEaA9Wip9TPP+szWC7SORTwrGKcq:LhzJG6E3TCGVq

Score
10/10
privateloaderevasiontrojan

Malware Config

Targets

    • Target

      sotema_5.txt.exe

    • Size

      773KB

    • MD5

      51e7f03ae54c977764c32b0dedf0b9ac

    • SHA1

      03cf8e81b1b8a96097c9e3da11f925e7dc6819b7

    • SHA256

      0580678f81e9801e3678c5d4cf1cfe674aa52ce95092e67908d6a7d4192a429b

    • SHA512

      03ea4d2dd652c3fd858c54cf579c410a12c7296acf222ebad57bcfaea33b71fc411122bc35a7b8ff56cb0254e42a6042fbe6efdb47a97ba61fb6ed15c9931661

    • SSDEEP

      24576:Wu/phBzW6ZEaA9Wip9TPP+szWC7SORTwrGKcq:LhzJG6E3TCGVq

    Score
    10/10
    evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks