6fb88aaebd6b776bf0c27b6dab120db933dad4a793cbd0218e8a4e89c0f52b68 | Triage

Sharing

General

Target

6fb88aaebd6b776bf0c27b6dab120db933dad4a793cbd0218e8a4e89c0f52b68
Size

68KB
Sample

240416-3h3wsahb2s
MD5

ebd87301def10760242a7afb88b155cb
SHA1

bd165fedd12da7228221b4e7a006ccc19b831d98
SHA256

6fb88aaebd6b776bf0c27b6dab120db933dad4a793cbd0218e8a4e89c0f52b68
SHA512

b7e0fc1085349eb052c18bef5eb17e1d452ded2de33d0ead34036a6f5417ae2339bd72ef10b7315e0f552af3b262830dbc09bfd6728d9d74879fae7e8244ca2b
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8p:Olg35GTslA5t3/w8p

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  6fb88aaebd6b776bf0c27b6dab120db933dad4a793cbd0218e8a4e89c0f52b68
- Size
  
  68KB
- MD5
  
  ebd87301def10760242a7afb88b155cb
- SHA1
  
  bd165fedd12da7228221b4e7a006ccc19b831d98
- SHA256
  
  6fb88aaebd6b776bf0c27b6dab120db933dad4a793cbd0218e8a4e89c0f52b68
- SHA512
  
  b7e0fc1085349eb052c18bef5eb17e1d452ded2de33d0ead34036a6f5417ae2339bd72ef10b7315e0f552af3b262830dbc09bfd6728d9d74879fae7e8244ca2b
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8p:Olg35GTslA5t3/w8p
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan