Overview

overview

7

Static

static

1

ActiveDirectory

macos-10.15-amd64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ActiveDirectory

  • Size

    39KB

  • Sample

    240425-htf6yagf9v

  • MD5

    ceb7ab00d30dd72b61b224d3b21e2fbc

  • SHA1

    7c6b84fb7a38118b5d0a73f762bcddb135cd884e

  • SHA256

    f2b2a07db11a8ccc3f7431c94130a48e746c1aa2129d9e805f4d6bb4d1fc422f

  • SHA512

    adf005949440685d838d5dd9f1c0b56bc028d10d2c4eee6278247a3c321a73501f296144d785bf60c538cc916ff3b2152de8fde187d85b551f1ae37c3153cd79

  • SSDEEP

    384:5U8YPULwdfgzFf+eh9HxpjACGIlK+yd2CZOW/m:5U8YPUMCf+a97ECGIQ+ydVZzO

Score
7/10
evasionexfiltrationmacos

Malware Config

Targets

    • Target

      ActiveDirectory

    • Size

      39KB

    • MD5

      ceb7ab00d30dd72b61b224d3b21e2fbc

    • SHA1

      7c6b84fb7a38118b5d0a73f762bcddb135cd884e

    • SHA256

      f2b2a07db11a8ccc3f7431c94130a48e746c1aa2129d9e805f4d6bb4d1fc422f

    • SHA512

      adf005949440685d838d5dd9f1c0b56bc028d10d2c4eee6278247a3c321a73501f296144d785bf60c538cc916ff3b2152de8fde187d85b551f1ae37c3153cd79

    • SSDEEP

      384:5U8YPULwdfgzFf+eh9HxpjACGIlK+yd2CZOW/m:5U8YPUMCf+a97ECGIQ+ydVZzO

    Score
    7/10
    evasionexfiltration

    • Exfiltration Over Alternative Protocol

      Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

      exfiltration

    • System Checks

      Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

      evasion
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Hide Artifacts

1
T1564

Resource Forking

1
T1564.009

Credential Access

Discovery

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Exfiltration

Exfiltration Over Alternative Protocol

1
T1048

Exfiltration Over Unencrypted Non-C2 Protocol

1
T1048.003

Command and Control

Impact

Resource Development

Reconnaissance

Tasks