2028f580d4e9dffcc18ea1afd0e49c602dc4fa6d8ad6d62493def50c5f4e3e8d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2028f580d4e9dffcc18ea1afd0e49c602dc4fa6d8ad6d62493def50c5f4e3e8d
Size

70KB
Sample

240510-x7qpvsge62
MD5

657c9b4cea8df48a49a661604bb1d193
SHA1

d1256b4780cd31a1d0be6387e83cb4055aaa4a95
SHA256

2028f580d4e9dffcc18ea1afd0e49c602dc4fa6d8ad6d62493def50c5f4e3e8d
SHA512

93b784c9e5171af162f9745a5ed7cccd544bc120c838c27f2219ab0ac7a6c259ab8c3c95b50189ef45c1c4e9e24cf2c454289e80c3e11a96c2bc23b0098cbc58
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8y:Olg35GTslA5t3/w8y

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  2028f580d4e9dffcc18ea1afd0e49c602dc4fa6d8ad6d62493def50c5f4e3e8d
- Size
  
  70KB
- MD5
  
  657c9b4cea8df48a49a661604bb1d193
- SHA1
  
  d1256b4780cd31a1d0be6387e83cb4055aaa4a95
- SHA256
  
  2028f580d4e9dffcc18ea1afd0e49c602dc4fa6d8ad6d62493def50c5f4e3e8d
- SHA512
  
  93b784c9e5171af162f9745a5ed7cccd544bc120c838c27f2219ab0ac7a6c259ab8c3c95b50189ef45c1c4e9e24cf2c454289e80c3e11a96c2bc23b0098cbc58
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8y:Olg35GTslA5t3/w8y
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan