6b429aa1d0d27695c2dc672c2960151b8e0c8706bcec89332de8491cbf29902b | Triage

Sharing

General

Target

ca5598376def17dbd0338edd6ad237f0_NEAS
Size

69KB
Sample

240507-svflxafd55
MD5

ca5598376def17dbd0338edd6ad237f0
SHA1

0208f2287739dc748b6abad1f6bcb7383fc6d09f
SHA256

6b429aa1d0d27695c2dc672c2960151b8e0c8706bcec89332de8491cbf29902b
SHA512

5f931ebf605e628b1c6fc741c283d7ee1c5e86313dacd44de513243e7be00a75dcfc403f34cb2bea5e929010a6ab16edd5c986c2ee2e2d6118164d2de0187820
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Dg:Olg35GTslA5t3/w8Dg

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  ca5598376def17dbd0338edd6ad237f0_NEAS
- Size
  
  69KB
- MD5
  
  ca5598376def17dbd0338edd6ad237f0
- SHA1
  
  0208f2287739dc748b6abad1f6bcb7383fc6d09f
- SHA256
  
  6b429aa1d0d27695c2dc672c2960151b8e0c8706bcec89332de8491cbf29902b
- SHA512
  
  5f931ebf605e628b1c6fc741c283d7ee1c5e86313dacd44de513243e7be00a75dcfc403f34cb2bea5e929010a6ab16edd5c986c2ee2e2d6118164d2de0187820
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8Dg:Olg35GTslA5t3/w8Dg
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan