vobfus | 77a5db8d7ca4b461425b56d503d40dd3145e4248f98eef964bdab4aabc8b66d9 | Triage

Sharing

General

Target

e99aba1cb656f2a49c17d01659ec11eb.zip
Size

83KB
Sample

240903-rarb8szdmh
MD5

ced2680a6c84b1d90a5fa0dbc35579fe
SHA1

be0ed22ced18e6eb7bc9099a4ebf1d0f809d966b
SHA256

77a5db8d7ca4b461425b56d503d40dd3145e4248f98eef964bdab4aabc8b66d9
SHA512

d2d8e5c48790b28512882431d2416634788736e8ac40b052d80131edfd06a987c77965c47fe9bec7d502c00aec6d186019162bb1adeea51d575ff56d2a8fbaa8
SSDEEP

1536:4yTxgmbsZVAD6mLTPi2LfBHz5/qE0i+Jgmdsyqa8jdf232uOCeftzSiM9+hHBp:4yTxNsvA5/Pi27BHM9vJ9OFjdf237OXp

Score

10^/10

vobfus discovery persistence worm

Malware Config

Targets

- Target
  
  23c6020a062d6b12c2a07dbb8dac544bbdc5df6155edb88570cdc259e60b18fe
- Size
  
  204KB
- MD5
  
  e99aba1cb656f2a49c17d01659ec11eb
- SHA1
  
  779059207f880ac82e029f3c90d6bec76cab91bf
- SHA256
  
  23c6020a062d6b12c2a07dbb8dac544bbdc5df6155edb88570cdc259e60b18fe
- SHA512
  
  ccf74a1b4d9e4f60de3c160b3cfb73e03699d3d9bd791928fba6085c94542fe7b77522ccf6d0ef28630cedd674c3fc2094f768c0c014e704b756f09b1f0174ad
- SSDEEP
  
  3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1:Xo/BHng5HaVG4G/1z+QVMbg1
Score

10^/10

vobfus discovery persistence worm
- Vobfus
  A widespread worm which spreads via network drives and removable media.
  worm vobfus
- Adds policy Run key to start application
  persistence
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

vobfusdiscoverypersistenceworm

behavioral2

vobfusdiscoverypersistenceworm