3179d385fa6210a6c531f45511a8b08ed05b5d1418d8192c2194444dc2d9faf1 | Triage

Sharing

General

Target

3179d385fa6210a6c531f45511a8b08ed05b5d1418d8192c2194444dc2d9faf1
Size

70KB
Sample

240521-zhx4rahg64
MD5

7e525f71f98b69fc12d02e785b6b1ccf
SHA1

c8ce6ff1673f99ce933b80825af5f062dfa855c7
SHA256

3179d385fa6210a6c531f45511a8b08ed05b5d1418d8192c2194444dc2d9faf1
SHA512

a9655e3ca168c3d66ba81cdc67d3fad88715cf9748e3a9c04a4d0f72966292a96a1365db63a49a3ecce1aa05351380d5bea96dd7493b1a78cbf6aef02176c8e8
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slc:Olg35GTslA5t3/w8f

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  3179d385fa6210a6c531f45511a8b08ed05b5d1418d8192c2194444dc2d9faf1
- Size
  
  70KB
- MD5
  
  7e525f71f98b69fc12d02e785b6b1ccf
- SHA1
  
  c8ce6ff1673f99ce933b80825af5f062dfa855c7
- SHA256
  
  3179d385fa6210a6c531f45511a8b08ed05b5d1418d8192c2194444dc2d9faf1
- SHA512
  
  a9655e3ca168c3d66ba81cdc67d3fad88715cf9748e3a9c04a4d0f72966292a96a1365db63a49a3ecce1aa05351380d5bea96dd7493b1a78cbf6aef02176c8e8
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slc:Olg35GTslA5t3/w8f
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan