Overview

overview

8

Static

static

3

AnyDesk.exe

windows10-2004-x64

8

AnyDesk.exe

windows10-ltsc_2021-x64

7

AnyDesk.exe

windows11-21h2-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AnyDesk.exe

  • Size

    5.4MB

  • Sample

    250327-qssscavk12

  • MD5

    f884234422e727ade2bcd29916264de1

  • SHA1

    c90743f008f4caa7caed9f4b9f2b82bc39f52aa1

  • SHA256

    29d11eff3ff64a53d41f94760f5170b4b176df6d2b7e276d5145c8e3bdaff2ce

  • SHA512

    2efffd5e385723e054c6b142454cd00860941caebad447d4cb305cf2b1052d2063c2bbe1adbbb5b9a04b46e5d0bbe7814f3a746a0570f9d0b4691c4c9b47008c

  • SSDEEP

    98304:pPdU+2966olQpKjALWuuvHemTHVfHsYFw4AMupfBcmGBTP8LanJbDrs:py+2r/pwALXuvH7eYlA1pfoqanB4

Score
8/10
discoverymotwphishing

Malware Config

Targets

    • Target

      AnyDesk.exe

    • Size

      5.4MB

    • MD5

      f884234422e727ade2bcd29916264de1

    • SHA1

      c90743f008f4caa7caed9f4b9f2b82bc39f52aa1

    • SHA256

      29d11eff3ff64a53d41f94760f5170b4b176df6d2b7e276d5145c8e3bdaff2ce

    • SHA512

      2efffd5e385723e054c6b142454cd00860941caebad447d4cb305cf2b1052d2063c2bbe1adbbb5b9a04b46e5d0bbe7814f3a746a0570f9d0b4691c4c9b47008c

    • SSDEEP

      98304:pPdU+2966olQpKjALWuuvHemTHVfHsYFw4AMupfBcmGBTP8LanJbDrs:py+2r/pwALXuvH7eYlA1pfoqanB4

    Score
    8/10
    discoverymotwphishing

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

      phishingmotw

    • Drops file in System32 directory

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks