167235b3f11374fd766d047e48eaca05587ca6ab1ab4bfab9a39bc8bebd3a8c9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

167235b3f11374fd766d047e48eaca05587ca6ab1ab4bfab9a39bc8bebd3a8c9.bin
Size

1.1MB
Sample

230506-zfc1ssce43
MD5

3c6b9ed83ec463ab847261669ddd03cd
SHA1

cfaaf6e983df990e429ed44d8a611ff76d2e9dd8
SHA256

167235b3f11374fd766d047e48eaca05587ca6ab1ab4bfab9a39bc8bebd3a8c9
SHA512

296a7152087340aa7cff26fac6c275f8c5b6e6c8c31886b6fced54c83b21fac05f7958e77109a886442fc41194adc0f1c3ca9a17835f44ae908ddc068a1c6e5c
SSDEEP

24576:Eykus7A+FocLFuis8rkY/nzPGXw6O/ny58J6VMbFJ:TkcTOA98P/zPj6O/nyY6VM

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  167235b3f11374fd766d047e48eaca05587ca6ab1ab4bfab9a39bc8bebd3a8c9.bin
- Size
  
  1.1MB
- MD5
  
  3c6b9ed83ec463ab847261669ddd03cd
- SHA1
  
  cfaaf6e983df990e429ed44d8a611ff76d2e9dd8
- SHA256
  
  167235b3f11374fd766d047e48eaca05587ca6ab1ab4bfab9a39bc8bebd3a8c9
- SHA512
  
  296a7152087340aa7cff26fac6c275f8c5b6e6c8c31886b6fced54c83b21fac05f7958e77109a886442fc41194adc0f1c3ca9a17835f44ae908ddc068a1c6e5c
- SSDEEP
  
  24576:Eykus7A+FocLFuis8rkY/nzPGXw6O/ny58J6VMbFJ:TkcTOA98P/zPj6O/nyY6VM
Score

10^/10

evasion persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan