Overview

overview

10

Static

static

10

Firefox Installer.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Firefox Installer.exe

  • Size

    188KB

  • Sample

    230710-tltylsbh82

  • MD5

    d8754b62c9e5fa6a98480f4ff45a2272

  • SHA1

    97187ad5f282caa38a08c2af5178d2d2508f2807

  • SHA256

    661cb7d69264a4953e0ec5d87b533e9e79c1b893b090d720a79692f7fb8f2a50

  • SHA512

    f0c1905dc644d7d394cea141c9a10dc7c85c591cc18d689f1f68615936dd5aabf84617f8bc4056d41801b5356e5af479d6384a95b9f5404ec20d5a52de1570b1

  • SSDEEP

    3072:oJZKnPE2YyJzELtyTRyYeY8lNgoiJ+sX8HFvytbaN+feQAcoQntK+C7VieM3SFZK:oJZKBI0RyYeY4eoiJ+sCFv9BPTQwX3Mp

Score
10/10
vanillaratpersistencerat

Malware Config

Targets

    • Target

      Firefox Installer.exe

    • Size

      188KB

    • MD5

      d8754b62c9e5fa6a98480f4ff45a2272

    • SHA1

      97187ad5f282caa38a08c2af5178d2d2508f2807

    • SHA256

      661cb7d69264a4953e0ec5d87b533e9e79c1b893b090d720a79692f7fb8f2a50

    • SHA512

      f0c1905dc644d7d394cea141c9a10dc7c85c591cc18d689f1f68615936dd5aabf84617f8bc4056d41801b5356e5af479d6384a95b9f5404ec20d5a52de1570b1

    • SSDEEP

      3072:oJZKnPE2YyJzELtyTRyYeY8lNgoiJ+sX8HFvytbaN+feQAcoQntK+C7VieM3SFZK:oJZKBI0RyYeY4eoiJ+sCFv9BPTQwX3Mp

    Score
    10/10
    vanillaratpersistencerat

    • VanillaRat

      VanillaRat is an advanced remote administration tool coded in C#.

      ratvanillarat

    • Vanilla Rat payload

      rat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks