a7f088a1cd622d248cd2904ba001c8d5eb9ee90db7fe6d043414bd513a6b0275 | Triage

Sharing

General

Target

f3b0179ba1f2f60ea88c4f14c4e7a829bin.zip
Size

2.4MB
Sample

231231-p3pyrsefb3
MD5

fe15867e6a3c6a4391c4c49129806ba5
SHA1

849e89db4dbe6f2c7ae8627467c3dc95ac6f9514
SHA256

a7f088a1cd622d248cd2904ba001c8d5eb9ee90db7fe6d043414bd513a6b0275
SHA512

9abb6f9225f333800bbb3186e0ab65fb946ae7fe635593aaa4012c4beaa58db7f8a5eb903a669aa4821699bf83d5774148739bd7c76813cd787487c6aaa0709e
SSDEEP

49152:SCkrvSQjhIE/hL5HT4JwTUNjsBC8uOr69eaytSlfhXEZXcVlbeZyDoys5I:WbSAhPFTymDGevafhIc373sC

Score

10^/10

google evasion persistence phishing trojan

Malware Config

Targets

- Target
  
  b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a.exe
- Size
  
  2.5MB
- MD5
  
  f3b0179ba1f2f60ea88c4f14c4e7a829
- SHA1
  
  cada0b63415bfdafac480da21742d673a6f1d359
- SHA256
  
  b35413142e0ffa56479335bb15a37fa10c531034b0bb137f5643969a0ae76b3a
- SHA512
  
  fd4f6e6eec6e565435c7fd7d6e5f79d7f59cca0e9ef068f370c65b270d5d4fa034b0990ecb8fb4427ee58ff5048b88130c2b80002e7d63a15c0b4aec2d342303
- SSDEEP
  
  49152:VkJD9VUS2v2/czNA6XgbuzDUyjYFb1nbuZvaMba5A7e0JSkJsGdLtFprqRbFFjfr:y9ESLEzNA6XAycRpuwiPBOGdZGxFFrJh
Score

10^/10

google evasion persistence phishing trojan
- Detected google phishing page
  phishing google
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

googleevasionpersistencephishingtrojan

behavioral2