945945f1f8c9f720f39ce1d736ffa65764a66e3679d94283591e6635837f1b89 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

945945f1f8c9f720f39ce1d736ffa65764a66e3679d94283591e6635837f1b89
Size

71KB
Sample

240526-a5ajjage7y
MD5

1ed5af94dee04be80c9b2978b46b7785
SHA1

0e8792abe52529b4f958003743637072ca56c2fd
SHA256

945945f1f8c9f720f39ce1d736ffa65764a66e3679d94283591e6635837f1b89
SHA512

2e42d54802830cafdafb3f8cca6fcc84bbabff5a0e5ba766e66503105a037886ec8ab43165ca2074fb893d9e0587188c6a47a177ce6e7f4f23c39024d8c5bd00
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slp:Olg35GTslA5t3/w8Y

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  945945f1f8c9f720f39ce1d736ffa65764a66e3679d94283591e6635837f1b89
- Size
  
  71KB
- MD5
  
  1ed5af94dee04be80c9b2978b46b7785
- SHA1
  
  0e8792abe52529b4f958003743637072ca56c2fd
- SHA256
  
  945945f1f8c9f720f39ce1d736ffa65764a66e3679d94283591e6635837f1b89
- SHA512
  
  2e42d54802830cafdafb3f8cca6fcc84bbabff5a0e5ba766e66503105a037886ec8ab43165ca2074fb893d9e0587188c6a47a177ce6e7f4f23c39024d8c5bd00
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slp:Olg35GTslA5t3/w8Y
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan