4b9fc67ce6e7ddb5d14827ff67e87377bfc458f12e12673617e52ae60fd6fad6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4b9fc67ce6e7ddb5d14827ff67e87377bfc458f12e12673617e52ae60fd6fad6
Size

70KB
Sample

240429-z43lcsce9y
MD5

1d5185c4cfc86b45b608bd6a984d33f4
SHA1

5c55087f88671683a6d7c07707559d3daba90953
SHA256

4b9fc67ce6e7ddb5d14827ff67e87377bfc458f12e12673617e52ae60fd6fad6
SHA512

b42bad594b508a25bffe270281b4fe38baa028e58e92f9016111a78f8098f51d9b5b109c9b7cc64514d851b8f062b6a8555f3dc96350b6ab53df61a368295d33
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slO:Olg35GTslA5t3/w8Z

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  4b9fc67ce6e7ddb5d14827ff67e87377bfc458f12e12673617e52ae60fd6fad6
- Size
  
  70KB
- MD5
  
  1d5185c4cfc86b45b608bd6a984d33f4
- SHA1
  
  5c55087f88671683a6d7c07707559d3daba90953
- SHA256
  
  4b9fc67ce6e7ddb5d14827ff67e87377bfc458f12e12673617e52ae60fd6fad6
- SHA512
  
  b42bad594b508a25bffe270281b4fe38baa028e58e92f9016111a78f8098f51d9b5b109c9b7cc64514d851b8f062b6a8555f3dc96350b6ab53df61a368295d33
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slO:Olg35GTslA5t3/w8Z
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan