6d472b5dbec6a653a92cd9b00912c849966abbe227d46964f743df0f3461447b | Triage

Sharing

General

Target

6d472b5dbec6a653a92cd9b00912c849966abbe227d46964f743df0f3461447b
Size

70KB
Sample

240522-2vyxxscb74
MD5

5a0e6efcc235a95035c86ec79ef68279
SHA1

ef1b1a630c6127bcc469cb4973916d9aca5e9662
SHA256

6d472b5dbec6a653a92cd9b00912c849966abbe227d46964f743df0f3461447b
SHA512

7e7f7434ded7c8299f28dda74467d26672fabb4a0ab06bfbcbf14c8ebe21a488decfae59765120befd94df83551a727ac26a76791b0f68ca2152782772f3d9de
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8IH:Olg35GTslA5t3/w8W

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  6d472b5dbec6a653a92cd9b00912c849966abbe227d46964f743df0f3461447b
- Size
  
  70KB
- MD5
  
  5a0e6efcc235a95035c86ec79ef68279
- SHA1
  
  ef1b1a630c6127bcc469cb4973916d9aca5e9662
- SHA256
  
  6d472b5dbec6a653a92cd9b00912c849966abbe227d46964f743df0f3461447b
- SHA512
  
  7e7f7434ded7c8299f28dda74467d26672fabb4a0ab06bfbcbf14c8ebe21a488decfae59765120befd94df83551a727ac26a76791b0f68ca2152782772f3d9de
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8IH:Olg35GTslA5t3/w8W
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan