2abd20acad4bc332f8f250193ef4e5a1063bc383933aeafe8c436360adef36cc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6169297057e90195a11aa0daa65cd161
Size

110KB
Sample

231226-kthe4sddh5
MD5

6169297057e90195a11aa0daa65cd161
SHA1

d2c0bfeef75d3eded911e7c58eb73a542289fc3d
SHA256

2abd20acad4bc332f8f250193ef4e5a1063bc383933aeafe8c436360adef36cc
SHA512

ca24c6a5c6b5afe241887fa1d1e4db1fe82c82c1731392a0ce5dc6090efe76754d515a6c36bd6fa964c74d173773881d14f0c0339f501158174c2c631a7ada0d
SSDEEP

3072:Brz/BRgd7NTpAb+ratuADH3YckoIrDgEm6:BP/BRgV33atjTkogDh

Score

8^/10

discovery

Malware Config

Targets

- Target
  
  PHOTO-DEVOCHKA.exe
- Size
  
  238KB
- MD5
  
  1414a0cf3ae3455f7445753aa9ef0ac9
- SHA1
  
  c6e63022a267155926638e028ba0bfafe614ff15
- SHA256
  
  2acd2fd6a3fbb4fe40a62ba571ed6015fdbec4a0a6aec9ccde3f33cbc803fee7
- SHA512
  
  939e9f2dca756893d04a1619537ee7e71c7eda27ebf9785b16fe0e892327ba23d2bbc54d82b97e590d803ce01d89087eaf24b330572aa5ba14c0668d9faf29b0
- SSDEEP
  
  6144:zbXE9OiTGfhEClq9rZXpdKw/F4qweYG3/jk8hqfFyBgRY7JJUm:/U9XiuiI
Score

8^/10

discovery
- Blocklisted process makes network request
- Drops file in Drivers directory
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2