Overview

overview

10

Static

static

3

efa6ac55f8...0d.exe

windows7-x64

10

efa6ac55f8...0d.exe

windows10-2004-x64

3

Scrubbiest.ps1

windows7-x64

8

Scrubbiest.ps1

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe

  • Size

    690KB

  • Sample

    240425-clzenadf5t

  • MD5

    bf86a2ca1461479a33c704c80cef8a6b

  • SHA1

    d1e328e1870c5c8b4cf9bf3af2188150c155a637

  • SHA256

    efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d

  • SHA512

    ab4ad977917361feb92122bff68d0bb3a2c8852a6afa78abded5353b2dc59deb8958738420af84e5f0e8630ea6d046e32ba089d25614373a263d173affed05cf

  • SSDEEP

    12288:60oU0UEneHuDY7nCkEPaT24WxsTI8okD70a2ybmDIj8+uu3M6Je0:mxneHuDYukEPAWxsTILkDB247uu39d

Score
10/10
guloaderdownloaderpersistence

Malware Config

Targets

    • Target

      efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d.exe

    • Size

      690KB

    • MD5

      bf86a2ca1461479a33c704c80cef8a6b

    • SHA1

      d1e328e1870c5c8b4cf9bf3af2188150c155a637

    • SHA256

      efa6ac55f8dbc8d81f1d82226090b0e7c84fac9a53bf597cbaa6623aff49310d

    • SHA512

      ab4ad977917361feb92122bff68d0bb3a2c8852a6afa78abded5353b2dc59deb8958738420af84e5f0e8630ea6d046e32ba089d25614373a263d173affed05cf

    • SSDEEP

      12288:60oU0UEneHuDY7nCkEPaT24WxsTI8okD70a2ybmDIj8+uu3M6Je0:mxneHuDYukEPAWxsTILkDB247uu39d

    Score
    10/10
    guloaderdownloaderpersistence

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      Scrubbiest.Chy

    • Size

      57KB

    • MD5

      36f3eda8b46d735a96cb9165b92d06d3

    • SHA1

      5b1a49b1eb273416216d37b658609bbef7476a7f

    • SHA256

      2b3fd293b418e5a6e53a9236a84e66b61e5d2831b19a0618b1fb3333ed8122fa

    • SHA512

      e280860d5d76bd7ebf97f02c4fb539d7349d616ac94dd2f6e3697a96a89afae4a904cca982863655d63fd8057c16201bc977b8f2929623a5940166b5e7180139

    • SSDEEP

      1536:orx2kV6Y42Fd/rMDrp0Odx8xKg376Kb3RMNx2yqQRGgD:orlx67C137pjmNx2HQRL

    Score
    8/10
    persistence

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks