Overview

overview

8

Static

static

7

Roshade.Se....0.exe

windows7-x64

7

Roshade.Se....0.exe

windows10-2004-x64

8

out.exe

windows7-x64

1

out.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Roshade.Setup.3.3.0.exe

  • Size

    5.5MB

  • Sample

    230328-vrzxgsdg7w

  • MD5

    c2455b603f5a4e995b7d5a184df3901d

  • SHA1

    77c2835e9a0894a998c61b33788146a6bb555722

  • SHA256

    97cf7c8d47708f23419e1277d0879bf2089b790aee5944555f6aeab700f4d64f

  • SHA512

    e82c162012f4a0528a58b0756b56b66697f4ae29d08290f3078a548520fae905eae444f43a7561be41a8a63274e240c25c8f0410e78d7fa273e7e893f9d5e727

  • SSDEEP

    98304:iyRWtk/CIxS5jouiKluqosq9eke1NQW3++MOySqDx8QxrahNsRRx4xRZAVMWtTje:hspr+eke1Nh3eNtxw1PZAftTC

Score
8/10
discoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      Roshade.Setup.3.3.0.exe

    • Size

      5.5MB

    • MD5

      c2455b603f5a4e995b7d5a184df3901d

    • SHA1

      77c2835e9a0894a998c61b33788146a6bb555722

    • SHA256

      97cf7c8d47708f23419e1277d0879bf2089b790aee5944555f6aeab700f4d64f

    • SHA512

      e82c162012f4a0528a58b0756b56b66697f4ae29d08290f3078a548520fae905eae444f43a7561be41a8a63274e240c25c8f0410e78d7fa273e7e893f9d5e727

    • SSDEEP

      98304:iyRWtk/CIxS5jouiKluqosq9eke1NQW3++MOySqDx8QxrahNsRRx4xRZAVMWtTje:hspr+eke1Nh3eNtxw1PZAftTC

    Score
    8/10
    upxdiscoveryevasionpersistencetrojan

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

    • Target

      out.upx

    • Size

      12.4MB

    • MD5

      f659ad5692cc169f44a77485279611eb

    • SHA1

      35862c78ef38d4ce3895ae71a4864c5ad0ec18dc

    • SHA256

      7334b1e6135de8bf13d5c24c9bce6451056c9f42047959ecc46ab2613c703b28

    • SHA512

      3e86362e95308d044adbf9e5477f33ae7d7b0f59208e06d2d622110e7386089a2fccfb4ba98c8fa96948a9e76fbad42980d7e23d089749cff4d881d2f9f064d5

    • SSDEEP

      98304:eUz0jXhJ2GXCPX2aksHTQlHnFRearSpJIK9qCI2+PxCWGoHpKPwmOrD7YZVY/2Rt:OzCvlEe/9VIbPxCWGoHAPwmO38Z2

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks