d2a8e9653736bba7d63ce69a4335ebf36668fd83f885c9e26f6b384d39a1999f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fead0ec8f60ddb8d689119d10f5c18ba
Size

241KB
Sample

231228-217r1shdfl
MD5

fead0ec8f60ddb8d689119d10f5c18ba
SHA1

de06b92c3f5943491d28946860e4fc643ce71150
SHA256

d2a8e9653736bba7d63ce69a4335ebf36668fd83f885c9e26f6b384d39a1999f
SHA512

0e0793498c749e78d87ce6a09436b4c928791db4d5fa3455fad531b888a32b0480551f9f89896f18b385d580e3e1f8b826793dffe6dfd95304342555e4af4f73
SSDEEP

3072:xNLThpZP1swRJIQDDRIuOH31q692XohYEnTwTn9gYCzo7i2RnoBJPWG/b4eRqRtj:7xCwwh1cgUTUz7b4eRqg8suvBtz1V

Score

7^/10

Malware Config

Targets

- Target
  
  fead0ec8f60ddb8d689119d10f5c18ba
- Size
  
  241KB
- MD5
  
  fead0ec8f60ddb8d689119d10f5c18ba
- SHA1
  
  de06b92c3f5943491d28946860e4fc643ce71150
- SHA256
  
  d2a8e9653736bba7d63ce69a4335ebf36668fd83f885c9e26f6b384d39a1999f
- SHA512
  
  0e0793498c749e78d87ce6a09436b4c928791db4d5fa3455fad531b888a32b0480551f9f89896f18b385d580e3e1f8b826793dffe6dfd95304342555e4af4f73
- SSDEEP
  
  3072:xNLThpZP1swRJIQDDRIuOH31q692XohYEnTwTn9gYCzo7i2RnoBJPWG/b4eRqRtj:7xCwwh1cgUTUz7b4eRqg8suvBtz1V
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2