Overview

overview

10

Static

static

10

a2c7b7cc84...eb.exe

windows7-x64

10

a2c7b7cc84...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2c7b7cc8423b1efec7868a8448730790a86a5fe45603441ed492131d197adeb

  • Size

    1.2MB

  • Sample

    240306-2c6j2sca5w

  • MD5

    da0bcec014e398e3faba845bd73cfbda

  • SHA1

    af957f165473b0ad284f0ecaa22aceada86c981d

  • SHA256

    a2c7b7cc8423b1efec7868a8448730790a86a5fe45603441ed492131d197adeb

  • SHA512

    f315030eed014bc206b44c5854d66b8cf4f13679308d4a7260fa36291634290dc363be644d3f93aef89e558e078db15aa502a181487ad4470ffb61b9325cecb1

  • SSDEEP

    24576:PFOa+uxkXWtPcZztujn7z3LG5KuRgPKvbJ7QDS9+uot:tNkXWNcRtuz7GI3yvV79a

Score
10/10
r77evasionpersistencerootkit

Malware Config

Targets

    • Target

      a2c7b7cc8423b1efec7868a8448730790a86a5fe45603441ed492131d197adeb

    • Size

      1.2MB

    • MD5

      da0bcec014e398e3faba845bd73cfbda

    • SHA1

      af957f165473b0ad284f0ecaa22aceada86c981d

    • SHA256

      a2c7b7cc8423b1efec7868a8448730790a86a5fe45603441ed492131d197adeb

    • SHA512

      f315030eed014bc206b44c5854d66b8cf4f13679308d4a7260fa36291634290dc363be644d3f93aef89e558e078db15aa502a181487ad4470ffb61b9325cecb1

    • SSDEEP

      24576:PFOa+uxkXWtPcZztujn7z3LG5KuRgPKvbJ7QDS9+uot:tNkXWNcRtuz7GI3yvV79a

    Score
    10/10
    r77evasionpersistencerootkit

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • r77

      r77 is an open-source, userland rootkit.

      rootkitr77

    • r77 rootkit payload

      Detects the payload of the r77 rootkit.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks