25ff9aca1e733c536f67cec06b0b311d8a0bedde590c4986127dffb3c1824a54 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1ef636adb1f5e8564a5cf040d20f94a9
Size

241KB
Sample

231230-2rs79sfahk
MD5

1ef636adb1f5e8564a5cf040d20f94a9
SHA1

24ae2f60529cb8a421f0780d7482f20474157357
SHA256

25ff9aca1e733c536f67cec06b0b311d8a0bedde590c4986127dffb3c1824a54
SHA512

75766224c276670d563f66cc763a467a8857ff9961fa3f9784da2fe282de45c6811039cf3cff4e6f2a344d9fe5e5caae48af1255a1d572af0cb82517f9f6114e
SSDEEP

6144:mUlwbOxQfy5voPruDFi62QdvBlzOHgb1i8WmrOBQzQBgUW5T:mUabOxtBmrB6NBoJ6e72

Score

7^/10

Malware Config

Targets

- Target
  
  1ef636adb1f5e8564a5cf040d20f94a9
- Size
  
  241KB
- MD5
  
  1ef636adb1f5e8564a5cf040d20f94a9
- SHA1
  
  24ae2f60529cb8a421f0780d7482f20474157357
- SHA256
  
  25ff9aca1e733c536f67cec06b0b311d8a0bedde590c4986127dffb3c1824a54
- SHA512
  
  75766224c276670d563f66cc763a467a8857ff9961fa3f9784da2fe282de45c6811039cf3cff4e6f2a344d9fe5e5caae48af1255a1d572af0cb82517f9f6114e
- SSDEEP
  
  6144:mUlwbOxQfy5voPruDFi62QdvBlzOHgb1i8WmrOBQzQBgUW5T:mUabOxtBmrB6NBoJ6e72
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2