3dba17277577ca708ce4df9eb02fedf35798fec80f9740fcbf53a1302b61ce89 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Virus.Sysbot.ATA_virussign.com_bef0e497c009b94458441a8bcd24af8a.exe
Size

67KB
Sample

240907-prg4savgre
MD5

bef0e497c009b94458441a8bcd24af8a
SHA1

90e378086d2b808052741c8f4843d4e5c29bc4dc
SHA256

3dba17277577ca708ce4df9eb02fedf35798fec80f9740fcbf53a1302b61ce89
SHA512

6d13a3137f4171c6124d9a3e8fbf2db88ba2fa531a86c69b802f68cbca9f34450ec31f6804f0cb4988ae4f43aa50f7efba77e820866a4f9827d3ceb01c2a1984
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+awJj:ulg35GTslA5t3GawJj

Score

10^/10

defense_evasion discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  Virus.Sysbot.ATA_virussign.com_bef0e497c009b94458441a8bcd24af8a.exe
- Size
  
  67KB
- MD5
  
  bef0e497c009b94458441a8bcd24af8a
- SHA1
  
  90e378086d2b808052741c8f4843d4e5c29bc4dc
- SHA256
  
  3dba17277577ca708ce4df9eb02fedf35798fec80f9740fcbf53a1302b61ce89
- SHA512
  
  6d13a3137f4171c6124d9a3e8fbf2db88ba2fa531a86c69b802f68cbca9f34450ec31f6804f0cb4988ae4f43aa50f7efba77e820866a4f9827d3ceb01c2a1984
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+awJj:ulg35GTslA5t3GawJj
Score

10^/10

defense_evasion discovery evasion persistence trojan
- Windows security bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Impair Defenses

Disable or Modify Tools

Indicator Removal

Clear Persistence

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistencetrojan

behavioral2

defense_evasiondiscoveryevasionpersistencetrojan