Overview

overview

8

Static

static

1

rhd modded...-1.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    rhd modded gun script - Linkvertise Downloader_C0Etv-1.exe

  • Size

    8.1MB

  • Sample

    230216-wgg5csah83

  • MD5

    cc2822d11b222408b485f298382b3420

  • SHA1

    be833e57e3d7a6a56a087a1c3edc5b17b403a434

  • SHA256

    f5c1cd9948f48ea9c98b2e3c8332980661daa1fb495b09991a080c03b21e13de

  • SHA512

    53a5b863efabf65f0801d3ceb68a567828cf71c04ce086430fdc25d15b3985088792cad8a4488a9fa06206e74544572e7142a26fbc353f68c9deeb578161adbf

  • SSDEEP

    196608:h38JJEU16hTZl583S0LJu+mzfDkzUoXOM1ughyt7p:m1MlCC0Ybzf4zUoXN8Bp

Score
8/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      rhd modded gun script - Linkvertise Downloader_C0Etv-1.exe

    • Size

      8.1MB

    • MD5

      cc2822d11b222408b485f298382b3420

    • SHA1

      be833e57e3d7a6a56a087a1c3edc5b17b403a434

    • SHA256

      f5c1cd9948f48ea9c98b2e3c8332980661daa1fb495b09991a080c03b21e13de

    • SHA512

      53a5b863efabf65f0801d3ceb68a567828cf71c04ce086430fdc25d15b3985088792cad8a4488a9fa06206e74544572e7142a26fbc353f68c9deeb578161adbf

    • SSDEEP

      196608:h38JJEU16hTZl583S0LJu+mzfDkzUoXOM1ughyt7p:m1MlCC0Ybzf4zUoXN8Bp

    Score
    8/10
    adwarediscoverypersistencestealer

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks