28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510
Size

881KB
Sample

231015-spvtmsae46
MD5

cc2e5e7ffc0133fc14e8654b0804bcec
SHA1

b3d0700fcb7934976388d2c0c17895e9e3f14bcb
SHA256

28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510
SHA512

c2e0d2c2fc35044475361a2778c589df7e15d621944d9d044f27face34a0d1a2e280cbeb378022431b3cd60b7ca9c2044f54d30a033f94c271f321f876e2ae84
SSDEEP

12288:3MrBy90z7T5xy2dMxJv2TMhvDddoEOHU3M6VndV8TgwlinSVb8YHIES0Vj3sS:yyQ5nyJkMhI503nVIiw4YHIlIj3sS

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510
- Size
  
  881KB
- MD5
  
  cc2e5e7ffc0133fc14e8654b0804bcec
- SHA1
  
  b3d0700fcb7934976388d2c0c17895e9e3f14bcb
- SHA256
  
  28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510
- SHA512
  
  c2e0d2c2fc35044475361a2778c589df7e15d621944d9d044f27face34a0d1a2e280cbeb378022431b3cd60b7ca9c2044f54d30a033f94c271f321f876e2ae84
- SSDEEP
  
  12288:3MrBy90z7T5xy2dMxJv2TMhvDddoEOHU3M6VndV8TgwlinSVb8YHIES0Vj3sS:yyQ5nyJkMhI503nVIiw4YHIlIj3sS
Score

10^/10

evasion persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan