General

  • Target

    a03913b0dcf4d9707eb9c74d69b522927e760e9be55effb0e14ebbbaad9177c7.exe

  • Size

    401KB

  • Sample

    240710-wqytgasbnn

  • MD5

    f1043033237fa935ef9af72415e657a1

  • SHA1

    b1ce2973b99811fe469ae6b4c450e97d4d4f4a20

  • SHA256

    a03913b0dcf4d9707eb9c74d69b522927e760e9be55effb0e14ebbbaad9177c7

  • SHA512

    1f4971262c297f2fa58234d7787ea384a168633eadce39e9334d9e7f5e5924b40eb47b84cc83ec8c29c62212863f17340a5525007d25f721c900e5583cf8dd3b

  • SSDEEP

    6144:FM23AboMfTvNXDQV1yKE2C7qNIZX8il32bcHXgjv3bO43f1WYq6cVjWZSlhhEV:nGoGNzQ+DZX8M2bc3Av3bO43tW5WZl

Malware Config

Targets

    • Target

      a03913b0dcf4d9707eb9c74d69b522927e760e9be55effb0e14ebbbaad9177c7.exe

    • Size

      401KB

    • MD5

      f1043033237fa935ef9af72415e657a1

    • SHA1

      b1ce2973b99811fe469ae6b4c450e97d4d4f4a20

    • SHA256

      a03913b0dcf4d9707eb9c74d69b522927e760e9be55effb0e14ebbbaad9177c7

    • SHA512

      1f4971262c297f2fa58234d7787ea384a168633eadce39e9334d9e7f5e5924b40eb47b84cc83ec8c29c62212863f17340a5525007d25f721c900e5583cf8dd3b

    • SSDEEP

      6144:FM23AboMfTvNXDQV1yKE2C7qNIZX8il32bcHXgjv3bO43f1WYq6cVjWZSlhhEV:nGoGNzQ+DZX8M2bc3Av3bO43tW5WZl

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks