Overview

overview

8

Static

static

1

image.png

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    image.png

  • Size

    32KB

  • Sample

    250113-rb2vcsvjex

  • MD5

    557824ce778bf500f5fd9ffc79526568

  • SHA1

    b888e5efcc8804b6bec0b7cba401f36f8132301b

  • SHA256

    750c111205a75420756345b4a9c7449a59d9573a4be6cbb660aef9d7f4c1b84d

  • SHA512

    b767fb6d168e615ba249a7b44de856b2feffc053eb2cdf35ae5adbed35508154136215c21abeb3397d8496d486b0d80b655f12693b32ca1eb9f0c528e4024e12

  • SSDEEP

    768:s4XRzAkefBiDj+dHe/Wz43+Lx9l42e4eyWrxeFi0e4hxc:xeYSHecH9l4nPr8FfeqC

Score
8/10
steamdefense_evasiondiscoverypersistencephishing

Malware Config

Targets

    • Target

      image.png

    • Size

      32KB

    • MD5

      557824ce778bf500f5fd9ffc79526568

    • SHA1

      b888e5efcc8804b6bec0b7cba401f36f8132301b

    • SHA256

      750c111205a75420756345b4a9c7449a59d9573a4be6cbb660aef9d7f4c1b84d

    • SHA512

      b767fb6d168e615ba249a7b44de856b2feffc053eb2cdf35ae5adbed35508154136215c21abeb3397d8496d486b0d80b655f12693b32ca1eb9f0c528e4024e12

    • SSDEEP

      768:s4XRzAkefBiDj+dHe/Wz43+Lx9l42e4eyWrxeFi0e4hxc:xeYSHecH9l4nPr8FfeqC

    Score
    8/10
    steamdefense_evasiondiscoverypersistencephishing

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Detected potential entity reuse from brand STEAM.

      phishingsteam

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks