General
- Target website_recipe_2.6-beta.1.zip
- Size 529KB
- Sample260622-ry4mgads8x
- SHA256 ee7cc9ae2819188ec2dcb0e929432a521f3d4c0f93f57774630e69c23b05c0f5
Score
8/10
Malware Config
Targets
-
- Target Launcher.cmd
- Size 26B
- SHA256 3f4c88d65a5b792d3234a8cb966154550f1d9b9eaefd2474c01f97b21f46733c
Score7/10-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target bytecode.txt
- Size 292KB
- SHA256 35d19eba58c4db6e034e7965ac41a2b02a26f26ca9cfcfb5ec8cb1690ec86c5e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target gcm.exe
- Size 753KB
- SHA256 4c469dadda5529047b063dd2e91ec36c409b4cbe6cf3576ae7db02e79e4d51f7
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1