da4f41c0ab457351e0a9204656aa7e9761980a022c4388874df993e6525ace33 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

82d774ff00c6626446e0d0de6a35fcd0_NEAS
Size

70KB
Sample

240507-ha1q8sdb3t
MD5

82d774ff00c6626446e0d0de6a35fcd0
SHA1

ccac4ba82134cb50e9603b65615a8dc22438e937
SHA256

da4f41c0ab457351e0a9204656aa7e9761980a022c4388874df993e6525ace33
SHA512

6d4a39be40984aa6384ac19d46e2a8a5eba8f2bb8fa164192b1393cceb61aefab043e065beec0a9e6b7096bf4f0ee6407f613ee6512916c86dd1affcb0d7462c
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8JJ2:Olg35GTslA5t3/w8JJ2

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  82d774ff00c6626446e0d0de6a35fcd0_NEAS
- Size
  
  70KB
- MD5
  
  82d774ff00c6626446e0d0de6a35fcd0
- SHA1
  
  ccac4ba82134cb50e9603b65615a8dc22438e937
- SHA256
  
  da4f41c0ab457351e0a9204656aa7e9761980a022c4388874df993e6525ace33
- SHA512
  
  6d4a39be40984aa6384ac19d46e2a8a5eba8f2bb8fa164192b1393cceb61aefab043e065beec0a9e6b7096bf4f0ee6407f613ee6512916c86dd1affcb0d7462c
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8JJ2:Olg35GTslA5t3/w8JJ2
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan