aae780339fc73d8e41b3ce7c1d266946e76b043d5e618400f1500853d3c22d2c | Triage

Sharing

General

Target

googlybear.exe.malware
Size

4.8MB
Sample

241121-qdhc3awrgp
MD5

c5bae064bacd74cc5398d569059c663c
SHA1

71af8d1183a77a844cf67c56be3a6d8ab8788fee
SHA256

aae780339fc73d8e41b3ce7c1d266946e76b043d5e618400f1500853d3c22d2c
SHA512

cd43a1190b5a4843b7cecb2837cb2196c7cd9360c1eb4472414270a4b04481df3f2ea703052e45c5be5ec187f7997d9410b86bf3bb236b31da1c7583282da7e6
SSDEEP

98304:6/tMaVRE4MVvSqEIE2hzTWkHvT9MMRP2y5MvUG1nYcv78Xvd:6/tMaVK4MpEIE295MMN/8B+cv78Xl

Score

7^/10

execution

Malware Config

Targets

- Target
  
  googlybear.exe.malware
- Size
  
  4.8MB
- MD5
  
  c5bae064bacd74cc5398d569059c663c
- SHA1
  
  71af8d1183a77a844cf67c56be3a6d8ab8788fee
- SHA256
  
  aae780339fc73d8e41b3ce7c1d266946e76b043d5e618400f1500853d3c22d2c
- SHA512
  
  cd43a1190b5a4843b7cecb2837cb2196c7cd9360c1eb4472414270a4b04481df3f2ea703052e45c5be5ec187f7997d9410b86bf3bb236b31da1c7583282da7e6
- SSDEEP
  
  98304:6/tMaVRE4MVvSqEIE2hzTWkHvT9MMRP2y5MvUG1nYcv78Xvd:6/tMaVK4MpEIE295MMN/8B+cv78Xl
Score

7^/10

execution
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1