ae5c5097584f225b2eec3981d0b35114971dbd53d93b6493e46718317e5239ca | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ae5c5097584f225b2eec3981d0b35114971dbd53d93b6493e46718317e5239caN
Size

44KB
Sample

240928-gchsrszbpn
MD5

a1acff31f5836eeb36e73fc1d8f0e810
SHA1

76010c230c6ef58e0ef6291666ef98d0583a6cba
SHA256

ae5c5097584f225b2eec3981d0b35114971dbd53d93b6493e46718317e5239ca
SHA512

f1dfff663dab92b1d2e761d1cb21da2f6042e3ec18c445f572efb590ab31639b4ed1aa19c066b1fd89d19c7a02444b33f347c9357020d338b5bbc146ffafffe3
SSDEEP

768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvavWPG7:RUNHFKQbIkHvGkAjt7

Score

10^/10

defense_evasion discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  ae5c5097584f225b2eec3981d0b35114971dbd53d93b6493e46718317e5239caN
- Size
  
  44KB
- MD5
  
  a1acff31f5836eeb36e73fc1d8f0e810
- SHA1
  
  76010c230c6ef58e0ef6291666ef98d0583a6cba
- SHA256
  
  ae5c5097584f225b2eec3981d0b35114971dbd53d93b6493e46718317e5239ca
- SHA512
  
  f1dfff663dab92b1d2e761d1cb21da2f6042e3ec18c445f572efb590ab31639b4ed1aa19c066b1fd89d19c7a02444b33f347c9357020d338b5bbc146ffafffe3
- SSDEEP
  
  768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvavWPG7:RUNHFKQbIkHvGkAjt7
Score

10^/10

defense_evasion discovery evasion persistence trojan
- Windows security bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Winlogon Helper DLL

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Impair Defenses

Disable or Modify Tools

Indicator Removal

Clear Persistence

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistencetrojan

behavioral2

defense_evasiondiscoveryevasionpersistencetrojan