Overview

overview

10

Static

static

10

AIDA.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AIDA.exe

  • Size

    1.4MB

  • Sample

    230526-m8a1pafb52

  • MD5

    69eec47380f487567aac36cc35d50826

  • SHA1

    8a983e57e7654527cd2827ece8f7d7c81175437e

  • SHA256

    b8b827cd176b26afa22b83db2c598961d4f67b454ca87f72774066cf692dab37

  • SHA512

    e1fc39f8cd9d41f5a30bd4dcb9b9e9953bb26dee553e84936441a38b15e19e2b93c6f4cb882420ccc722a112a314de2fdc08768cbfc65efbb943ac67c2413182

  • SSDEEP

    24576:d4PbCGol1MBz4VrqabgBs/8KmXOoU5Ll7cZFT//yLQxoz4zKot2:ahWAUrqQg632T//Oz4zKR

Score
10/10
darkcometneshtaevasionpersistenceratspywarestealertrojanupx

Malware Config

Targets

    • Target

      AIDA.exe

    • Size

      1.4MB

    • MD5

      69eec47380f487567aac36cc35d50826

    • SHA1

      8a983e57e7654527cd2827ece8f7d7c81175437e

    • SHA256

      b8b827cd176b26afa22b83db2c598961d4f67b454ca87f72774066cf692dab37

    • SHA512

      e1fc39f8cd9d41f5a30bd4dcb9b9e9953bb26dee553e84936441a38b15e19e2b93c6f4cb882420ccc722a112a314de2fdc08768cbfc65efbb943ac67c2413182

    • SSDEEP

      24576:d4PbCGol1MBz4VrqabgBs/8KmXOoU5Ll7cZFT//yLQxoz4zKot2:ahWAUrqQg632T//Oz4zKR

    Score
    10/10
    darkcometneshtaevasionpersistenceratspywarestealertrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Detect Neshta payload

    • Modifies security service

      evasion

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Change Default File Association

1
T1042

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks