Extracted

• • Target

    The-MALWARE-Repo

  • Size

    284KB

  • MD5

    1c0a02c3390b9fd77746574def84b1d1

  • SHA1

    2e62ae7936cf5b6398308f702ddbb06427091109

  • SHA256

    29dc64e0ada4c711d0452801d3364b2f44cf4bd52337547aaa2f40744da97cd1

  • SHA512

    4f62bc5c219a6fa412dc06653227561b10cb32d144be733e0b2e57dea24baa17683dc09b84c57237326e6909e27f42ea7e1f70032eeff455d12423364bc433a2

  • SSDEEP

    6144:ibRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvZJT3CqbMrhryfQNRPaCieMjAkvCJv1VZ:qRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvC

  Score

  10^/10

  evasionexecutionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Executes dropped EXE

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1