6496d4249261a12ff6a3546262ffe90931b59e4d4542ebe057fc9c1baf097b6e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

38cf765ca753d4309215eb08ad61e288
Size

506KB
Sample

231231-q7pn8sahg9
MD5

38cf765ca753d4309215eb08ad61e288
SHA1

dd08d70f41d44bdaeeb8eacc8135a7d3b2670b50
SHA256

6496d4249261a12ff6a3546262ffe90931b59e4d4542ebe057fc9c1baf097b6e
SHA512

648cf5d3c366b27db1bcb68a482c19842f9d169be4f08011f4310245f7b70abc88542d42aab5fce07dbb49a2322712536c9d334c283f4dc1fa159afecfee7c03
SSDEEP

12288:lU9Nusdjbzmrdp+gijasOzKbtLmG/ZP16RISeKs:6hN2Z2BOzK5qkZkzs

Score

7^/10

Malware Config

Targets

- Target
  
  38cf765ca753d4309215eb08ad61e288
- Size
  
  506KB
- MD5
  
  38cf765ca753d4309215eb08ad61e288
- SHA1
  
  dd08d70f41d44bdaeeb8eacc8135a7d3b2670b50
- SHA256
  
  6496d4249261a12ff6a3546262ffe90931b59e4d4542ebe057fc9c1baf097b6e
- SHA512
  
  648cf5d3c366b27db1bcb68a482c19842f9d169be4f08011f4310245f7b70abc88542d42aab5fce07dbb49a2322712536c9d334c283f4dc1fa159afecfee7c03
- SSDEEP
  
  12288:lU9Nusdjbzmrdp+gijasOzKbtLmG/ZP16RISeKs:6hN2Z2BOzK5qkZkzs
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2