5e615620f5cf47b4af2d96d1cba2d2440fe6fcf442ed2d9b38b2e6f5d182ad4e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5e615620f5cf47b4af2d96d1cba2d2440fe6fcf442ed2d9b38b2e6f5d182ad4e
Size

69KB
Sample

240305-zr4mwsab77
MD5

2b2203f1c2e0f699723d0d51bff899ad
SHA1

cec5b5ec4d3557b90855513fca3e75b47d0dbf22
SHA256

5e615620f5cf47b4af2d96d1cba2d2440fe6fcf442ed2d9b38b2e6f5d182ad4e
SHA512

1461a315251d0958e7e38dff81a87cf3ed9361f24613c05ea59c187d9214d4fd0eedfed6fcf77cfca8f87fec1bd439b9fd5e2a6a08b626d61262414736e1fde6
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8CG8Eu:Olg35GTslA5t3/w8oEu

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  5e615620f5cf47b4af2d96d1cba2d2440fe6fcf442ed2d9b38b2e6f5d182ad4e
- Size
  
  69KB
- MD5
  
  2b2203f1c2e0f699723d0d51bff899ad
- SHA1
  
  cec5b5ec4d3557b90855513fca3e75b47d0dbf22
- SHA256
  
  5e615620f5cf47b4af2d96d1cba2d2440fe6fcf442ed2d9b38b2e6f5d182ad4e
- SHA512
  
  1461a315251d0958e7e38dff81a87cf3ed9361f24613c05ea59c187d9214d4fd0eedfed6fcf77cfca8f87fec1bd439b9fd5e2a6a08b626d61262414736e1fde6
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8CG8Eu:Olg35GTslA5t3/w8oEu
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan