dc0a497dc265244e76de02361f220cd44b2a7d9452d204696b9da13fef9ccb9b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56f01c3144a86360fee63a5b3250d476
Size

266KB
Sample

240112-ttylrscbe6
MD5

56f01c3144a86360fee63a5b3250d476
SHA1

b38154e642848fb74d50e585c9b5162b3948be9f
SHA256

dc0a497dc265244e76de02361f220cd44b2a7d9452d204696b9da13fef9ccb9b
SHA512

046e3ddf533738f5210761d376ff773ee3d9935219bd63b06d73611977a221971fefd3e6f48572e0edb08a04fb60148e837ae47db6acaec36393d38a247649a8
SSDEEP

3072:XaUvoTWEmvuXdAsR+xqLr4aS13sD6aq8x:t19uXdDQ13suf8x

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  56f01c3144a86360fee63a5b3250d476
- Size
  
  266KB
- MD5
  
  56f01c3144a86360fee63a5b3250d476
- SHA1
  
  b38154e642848fb74d50e585c9b5162b3948be9f
- SHA256
  
  dc0a497dc265244e76de02361f220cd44b2a7d9452d204696b9da13fef9ccb9b
- SHA512
  
  046e3ddf533738f5210761d376ff773ee3d9935219bd63b06d73611977a221971fefd3e6f48572e0edb08a04fb60148e837ae47db6acaec36393d38a247649a8
- SSDEEP
  
  3072:XaUvoTWEmvuXdAsR+xqLr4aS13sD6aq8x:t19uXdDQ13suf8x
Score

10^/10

evasion persistence trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan