6f6ad3f3020f2e7e606eb3b358ba0c8f1441325c36d00f8dc853ec6718d779a2 | Triage

Sharing

General

Target

6f6ad3f3020f2e7e606eb3b358ba0c8f1441325c36d00f8dc853ec6718d779a2
Size

70KB
Sample

240428-2csyysaf99
MD5

4ffa9db5f338a1e254466138701c9206
SHA1

6a60ee29ba7f65c20c1448445b826ba7b5cbd909
SHA256

6f6ad3f3020f2e7e606eb3b358ba0c8f1441325c36d00f8dc853ec6718d779a2
SHA512

f67efbb3d636b3973511943d2aaac72e9c36ad41debf5c589a64a3ef16f39956d8967d4a3b678c7ab69f40dfba83d1c2e2b830645a6206e867512fa9f43a11b5
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slu:Olg35GTslA5t3/w8X

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  6f6ad3f3020f2e7e606eb3b358ba0c8f1441325c36d00f8dc853ec6718d779a2
- Size
  
  70KB
- MD5
  
  4ffa9db5f338a1e254466138701c9206
- SHA1
  
  6a60ee29ba7f65c20c1448445b826ba7b5cbd909
- SHA256
  
  6f6ad3f3020f2e7e606eb3b358ba0c8f1441325c36d00f8dc853ec6718d779a2
- SHA512
  
  f67efbb3d636b3973511943d2aaac72e9c36ad41debf5c589a64a3ef16f39956d8967d4a3b678c7ab69f40dfba83d1c2e2b830645a6206e867512fa9f43a11b5
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slu:Olg35GTslA5t3/w8X
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan