General
- Target LDPlayer9_ens_1001_ld.exe
- Size 2.2MB
- Sample250615-gpcsaayzgz
- SHA256 f99ec83edac3b6452104251551732529352f1a4425e0114b71658e9fb2c73ada
Malware Config
Targets
-
- Target LDPlayer9_ens_1001_ld.exe
- Size 2.2MB
- SHA256 f99ec83edac3b6452104251551732529352f1a4425e0114b71658e9fb2c73ada
Score10/10-
Guerrilla
Guerrilla is an Android malware used by the Lemon Group threat actor.
-
Guerrilla family
-
Guerrilla payload
-
Otpstealer
Otpstealer is an Android SMS Stealer that targets OTP first seen in February 2022.
-
Otpstealer family
-
Otpstealer payload
-
Creates new service(s)
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Possible privilege escalation attempt
-
Modifies file permissions
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1