fa01dc01d0271ce2ca7dedb36ee786954b3424f848be600ec509f256a9238274 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a42588f7365436cf28c8eac0b059d31f
Size

506KB
Sample

240225-szv76aeg57
MD5

a42588f7365436cf28c8eac0b059d31f
SHA1

1ebf4c805424f68a6a481e59d2b4e74c8417f9e7
SHA256

fa01dc01d0271ce2ca7dedb36ee786954b3424f848be600ec509f256a9238274
SHA512

6398ebf11e4ee2e504febf2b8d82023b73406f3530d696a5c7470cdd63131a4281796463d3419edf73078c414e432e2a7dc58cf804b397178c8840463163fd98
SSDEEP

12288:OO28o5O1Tpgz/+lUMw0RIyFKccIZXbTvhIkmoPEasKbH9hm8PhNK8OYTZu0:wSTSz/+lUMhI4lcIZHvKJ4H9zNLOY9u0

Score

7^/10

Malware Config

Targets

- Target
  
  a42588f7365436cf28c8eac0b059d31f
- Size
  
  506KB
- MD5
  
  a42588f7365436cf28c8eac0b059d31f
- SHA1
  
  1ebf4c805424f68a6a481e59d2b4e74c8417f9e7
- SHA256
  
  fa01dc01d0271ce2ca7dedb36ee786954b3424f848be600ec509f256a9238274
- SHA512
  
  6398ebf11e4ee2e504febf2b8d82023b73406f3530d696a5c7470cdd63131a4281796463d3419edf73078c414e432e2a7dc58cf804b397178c8840463163fd98
- SSDEEP
  
  12288:OO28o5O1Tpgz/+lUMw0RIyFKccIZXbTvhIkmoPEasKbH9hm8PhNK8OYTZu0:wSTSz/+lUMhI4lcIZHvKJ4H9zNLOY9u0
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2