General
- Target Open_AG_Patcher_Windows.exe
- Size 8.3MB
- Sample260604-mvndvsdx5n
- SHA256 8a048fd97ac0765e97be65fd2fd9ea0d12298b365317257e1816241b7d8b3e90
Score
8/10
Malware Config
Targets
-
- Target Open_AG_Patcher_Windows.exe
- Size 8.3MB
- SHA256 8a048fd97ac0765e97be65fd2fd9ea0d12298b365317257e1816241b7d8b3e90
Score8/10Downloads MZ/PE file
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Executes dropped EXE
Loads dropped DLL
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Authentication Process
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1