Overview

overview

10

Static

static

1

4ceded8819...ef.exe

windows7-x64

10

4ceded8819...ef.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.zip
  • Size 633KB
  • Sample240402-l4p4daed83
  • SHA256 bd59e50bd956f6ef82d05a2a9f945543cc3c4868a6916f772b6f53d51f804903
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
netdookaevasionloaderpersistencerat

Malware Config

Extracted

Family

  • netdooka

C2

  • 

Targets

    • Target
      4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
    • Size 660KB
    • SHA256 4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    netdookaevasionloaderpersistencerat

    • NetDooka

      NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.

      loaderratnetdooka

    • Creates new service(s)

      persistence

    • Stops running service(s)

      evasion

    • Checks for any installed AV software in registry

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks