General

  • Target

    c58fd9e3c3f219570c47c3b0c07bcd2ea7086cb7e8f2ea5264d82accffd281c8N

  • Size

    90KB

  • Sample

    241109-nqfznatenb

  • MD5

    d3f6a6a90d73c7115376c3c91b742790

  • SHA1

    c516d3ebb9ce03bb8c2e83e8d8683e67a512c6e0

  • SHA256

    c58fd9e3c3f219570c47c3b0c07bcd2ea7086cb7e8f2ea5264d82accffd281c8

  • SHA512

    c51b300e843ccaa33857e9a9a08f4e08cc82dc7f6cc9069389cfa45d0d1c82eb3c2e9234b58c0ba742538de25ccaed783175caed5e3c5b96f3eca6ac1509f599

  • SSDEEP

    1536:ERsjdf1aM67v32Z9x5nouy8VTFvRsjdf1aM67v32Z9x5nouy8VT:EOaHv3YpoutNFvOaHv3YpoutN

Malware Config

Targets

    • Target

      c58fd9e3c3f219570c47c3b0c07bcd2ea7086cb7e8f2ea5264d82accffd281c8N

    • Size

      90KB

    • MD5

      d3f6a6a90d73c7115376c3c91b742790

    • SHA1

      c516d3ebb9ce03bb8c2e83e8d8683e67a512c6e0

    • SHA256

      c58fd9e3c3f219570c47c3b0c07bcd2ea7086cb7e8f2ea5264d82accffd281c8

    • SHA512

      c51b300e843ccaa33857e9a9a08f4e08cc82dc7f6cc9069389cfa45d0d1c82eb3c2e9234b58c0ba742538de25ccaed783175caed5e3c5b96f3eca6ac1509f599

    • SSDEEP

      1536:ERsjdf1aM67v32Z9x5nouy8VTFvRsjdf1aM67v32Z9x5nouy8VT:EOaHv3YpoutNFvOaHv3YpoutN

    • Modifies WinLogon for persistence

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Disables RegEdit via registry modification

    • Disables use of System Restore points

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Adds Run key to start application

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks