00465a6a0df80b9136a40f295febb242ef3eb3a81c24c643aa6639aa79414f84 | Triage

Sharing

General

Target

2024-06-28_4a0924c3e7079e44966246c1057de747_mafia
Size

1.0MB
Sample

240628-edxbfazcle
MD5

4a0924c3e7079e44966246c1057de747
SHA1

9ae9a85cdcba274150a561590ceb709cc5ca4508
SHA256

00465a6a0df80b9136a40f295febb242ef3eb3a81c24c643aa6639aa79414f84
SHA512

4962f7caec157e7f6beaba4c0824b6012edab366bd6cf849bad2ed70645ed6db9fe015b1359ea68f201f1797c473c134958446c32949e62e3670c7389f89871b
SSDEEP

24576:HG2EgSiOmJK8f40qsis1fL+rwyf5OH/ItewTvBy81u8vLHII/GY:HGMSiiFs1aR5OH4nBynqII

Score

10^/10

evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  2024-06-28_4a0924c3e7079e44966246c1057de747_mafia
- Size
  
  1.0MB
- MD5
  
  4a0924c3e7079e44966246c1057de747
- SHA1
  
  9ae9a85cdcba274150a561590ceb709cc5ca4508
- SHA256
  
  00465a6a0df80b9136a40f295febb242ef3eb3a81c24c643aa6639aa79414f84
- SHA512
  
  4962f7caec157e7f6beaba4c0824b6012edab366bd6cf849bad2ed70645ed6db9fe015b1359ea68f201f1797c473c134958446c32949e62e3670c7389f89871b
- SSDEEP
  
  24576:HG2EgSiOmJK8f40qsis1fL+rwyf5OH/ItewTvBy81u8vLHII/GY:HGMSiiFs1aR5OH4nBynqII
Score

10^/10

evasion persistence privilege_escalation trojan
- Windows security bypass
  evasion trojan
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalationtrojan

behavioral2

evasionpersistenceprivilege_escalationtrojan