Overview

overview

10

Static

static

3

start_yara.exe

windows7-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    start_yara.exee
  • Size 4.6MB
  • Sample240910-j1bepstdmj
  • SHA256 bf2a11710eb16103afbcb200979c9a6de040a9b6d5e77bde5d6a93b5837aa6f1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikeindustroyermerlinnetfilternetwireremcossnakekeyloggerbackdoorbotnetdiscoveryicskeyloggerratrootkitstealertrojan

Malware Config

Targets

    • Target
      start_yara.exee
    • Size 4.6MB
    • SHA256 bf2a11710eb16103afbcb200979c9a6de040a9b6d5e77bde5d6a93b5837aa6f1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    cobaltstrikeindustroyermerlinnetfilternetwireremcossnakekeyloggerbackdoorbotnetdiscoveryicskeyloggerratrootkitstealertrojan

    • Cobalt Strike reflective loader

      Detects the reflective loader used by Cobalt Strike.

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Industroyer

      Also known as CrashOverride. Malware framework which targets Industrial Control Systems (ICS) related to power transmission.

      icsindustroyer

    • Industroyer IEC-104 Module

      Contains strings related to Industroyer module used to communicate with power transmission grids over IEC-104 protocol.

    • Merlin

      Merlin is a cross-platform post-exploitation C2 framework written in golang.

      backdoormerlin

    • Merlin payload

    • NetFilter

      NetFilter is a rootkit first seen in June 2021.

      rootkitnetfilter

    • NetFilter payload

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks