Overview

overview

10

Static

static

1

Tripleness.exe

windows7-x64

10

Tripleness.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d0e67f5e5afbbb8bf0bb4d1e3adf34daa4fbed3740e25c80b85b62e5eaa9dad

  • Size

    791KB

  • Sample

    240920-bshvta1frd

  • MD5

    c8bd4dcbf7c45c7931f2100c428b12e4

  • SHA1

    06a998079d82bef2e3c9a31704c614d0e889e9f5

  • SHA256

    0d0e67f5e5afbbb8bf0bb4d1e3adf34daa4fbed3740e25c80b85b62e5eaa9dad

  • SHA512

    33fcee57e75f6d07b66a25148daf7ef31c8dbebfa0ee48a37f1fd8929355eb56d24fcd3eb325c8851f9f27b63a8e36e64bee83d504f35a49a3f6b32224ea44ee

  • SSDEEP

    12288:VzuA+Znodvd/29jOHyEmyO3z0Kjh2FQ7bnibMIZU9AED7O3sU+n5htecCOV3fkUT:VC7oBx2EHj3g19D7+s97tecCKdT

Score
10/10
guloaderdiscoverydownloaderexecution

Malware Config

Targets

    • Target

      Tripleness.exe

    • Size

      1.1MB

    • MD5

      2f513d44fd0845e6cdbabc874dc55a53

    • SHA1

      bc19d6af2ea26015793bc6ffbe8527254d5c4e58

    • SHA256

      f320ff644d3fdfa1aab47e0e534e0c109cdc85022a7b692559c27a16e94696fa

    • SHA512

      5bfdaff3ce7ed5c0f39f4584ca82b0c121ce36a29e3e1b0130cfef53a92d776476c9a67f69a38bdbd7a388142d715d91941e7636d8acefd1c078352f3dce2846

    • SSDEEP

      12288:Cm12amGfy0D581DiNyQm6m3zwKjhMDQ73Ti/aG7cJEgH7K3UK+n1hxOcCMV3fAy9:Cmrm70l81DiNhbghFH7qUrvxOcC899

    Score
    10/10
    guloaderdiscoverydownloaderexecution

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks