General

  • Target

    Backdoor.Win32.IRCNite.ihg5616c57686191e6c65808ffe8a436e8d1476b1f6c0765efdb887498b86d4d446.bin

  • Size

    112KB

  • Sample

    230507-gy9hlshg5s

  • MD5

    438c80fc376c0e3d3379ffec5a3bcd74

  • SHA1

    6da1a89fbe0df57349bbc670af8f82deecb510b9

  • SHA256

    5616c57686191e6c65808ffe8a436e8d1476b1f6c0765efdb887498b86d4d446

  • SHA512

    87b6bbfd988ce9d398d2d5ac2c75c02b040760120bf0d276dd790adb0497fb330f4f98c76afed8ed3ff6e6541d9442bf0c4ee52c236f43cb601dce7042fcc56f

  • SSDEEP

    1536:jJg+WBW+f5bB77w0DSnVZsGw+14IUTGReGpBM9FTLPfpXwvdJic5a5a5n:jhLYZB77w0AZsGYIJVpEtjBpB5in

Malware Config

Targets

    • Target

      Backdoor.Win32.IRCNite.ihg5616c57686191e6c65808ffe8a436e8d1476b1f6c0765efdb887498b86d4d446.bin

    • Size

      112KB

    • MD5

      438c80fc376c0e3d3379ffec5a3bcd74

    • SHA1

      6da1a89fbe0df57349bbc670af8f82deecb510b9

    • SHA256

      5616c57686191e6c65808ffe8a436e8d1476b1f6c0765efdb887498b86d4d446

    • SHA512

      87b6bbfd988ce9d398d2d5ac2c75c02b040760120bf0d276dd790adb0497fb330f4f98c76afed8ed3ff6e6541d9442bf0c4ee52c236f43cb601dce7042fcc56f

    • SSDEEP

      1536:jJg+WBW+f5bB77w0DSnVZsGw+14IUTGReGpBM9FTLPfpXwvdJic5a5a5n:jhLYZB77w0AZsGYIJVpEtjBpB5in

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

2
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

8
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Discovery

System Information Discovery

1
T1082

Tasks