Overview

overview

9

Static

static

1

AnyDesk.exe

windows10-2004-x64

9

Resubmissions

02/10/2023, 18:46

231002-xesczsfe69 5

02/10/2023, 18:29

231002-w448eafd54 3

02/10/2023, 03:18

231002-dtp2magg38 3

01/10/2023, 20:52

231001-znrtxsfc27 3

27/08/2023, 20:25

230827-y698jseh6w 9

27/08/2023, 20:19

230827-y4ad5sda59 3

27/08/2023, 02:57

230827-dftsnafb27 8

06/07/2023, 23:58

230706-3z456sfh21 5

06/07/2023, 21:10

230706-zz95msfd4v 5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AnyDesk.exe

  • Size

    3.9MB

  • Sample

    230827-y698jseh6w

  • MD5

    30c9c57aa570088d745fac7bfd05b805

  • SHA1

    d579d18848859614e219afa6332d410e0ca71fc3

  • SHA256

    8cd552392bb25546ba58e73d63c4b7c290188ca1060f96c8abf641ae9f5a8383

  • SHA512

    182dc736cf09e8b4e063b29c839999ab28506a71e22173484f9dbc9bf9472456406aa0c8de542d85436200317175f9e32d65f1bb1e567b8c717860348fd3b52c

  • SSDEEP

    98304:oOmZb0bHkeaRs4WpcF8uztWOiiROB4/Oo1sRF:rmZb0bEds4XFR0OiC/GT

Score
9/10
discoverypersistence

Malware Config

Targets

    • Target

      AnyDesk.exe

    • Size

      3.9MB

    • MD5

      30c9c57aa570088d745fac7bfd05b805

    • SHA1

      d579d18848859614e219afa6332d410e0ca71fc3

    • SHA256

      8cd552392bb25546ba58e73d63c4b7c290188ca1060f96c8abf641ae9f5a8383

    • SHA512

      182dc736cf09e8b4e063b29c839999ab28506a71e22173484f9dbc9bf9472456406aa0c8de542d85436200317175f9e32d65f1bb1e567b8c717860348fd3b52c

    • SSDEEP

      98304:oOmZb0bHkeaRs4WpcF8uztWOiiROB4/Oo1sRF:rmZb0bEds4XFR0OiC/GT

    Score
    9/10
    discoverypersistence

    • Contacts a large (4332) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Adds Run key to start application

      persistence

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks