df4ab92cd20a49d66e2be8df002f6a8c9cdc12b63987f87929d51678e8ce79b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

gdifuncs.exe
Size

5.5MB
Sample

241003-qs5f5sycjr
MD5

d32930e262622bc6014227afd3863f83
SHA1

4ddc2ea5bba8be3c6ccbdf4a2d5995eff75bd7c2
SHA256

df4ab92cd20a49d66e2be8df002f6a8c9cdc12b63987f87929d51678e8ce79b9
SHA512

bc56f5a9d567f882095d138e9d77ef7ac5c2c05b91eb9040ecdbd771f44a594504a5a7472eb347d5cbe2b451355492103b3a6f36ad2cab4a74e4796996fca98b
SSDEEP

98304:mDFrA8y4D+i4DBz2NHlruSSDllNmd+5z/Le7q2//Le7q2:mD5y4D+i4DZmLclKez/Lkq4/Lkq

Score

10^/10

discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  gdifuncs.exe
- Size
  
  5.5MB
- MD5
  
  d32930e262622bc6014227afd3863f83
- SHA1
  
  4ddc2ea5bba8be3c6ccbdf4a2d5995eff75bd7c2
- SHA256
  
  df4ab92cd20a49d66e2be8df002f6a8c9cdc12b63987f87929d51678e8ce79b9
- SHA512
  
  bc56f5a9d567f882095d138e9d77ef7ac5c2c05b91eb9040ecdbd771f44a594504a5a7472eb347d5cbe2b451355492103b3a6f36ad2cab4a74e4796996fca98b
- SSDEEP
  
  98304:mDFrA8y4D+i4DBz2NHlruSSDllNmd+5z/Le7q2//Le7q2:mD5y4D+i4DZmLclKez/Lkq4/Lkq
Score

10^/10

discovery evasion persistence trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistencetrojan

behavioral2

discoveryevasionpersistencetrojan