fc4fc5613d89e5306b2df299a1ff67d252a94e08ba3dd729379e19aaf0ff671f

General

Target
Phish.exe
Size 33.8MB
Sample260625-2w2efafx5v
SHA256 fc4fc5613d89e5306b2df299a1ff67d252a94e08ba3dd729379e19aaf0ff671f
MD5 731d1da6a4c17e1d581554bbe9ed4e47
SHA1 a428f487d7214e9ee447900ceffdf5ca789c3bdf
SHA512 3f94f4b0853103c31c008ba005adfe5b39d91c49d079181a8c29482a11d2a1928fc2d18e1b0fc9c0e4bd2670cb1998a6ecc66159894e3fa7e959a114938c266f
SSDEEP 786432:aKDHMykyFjHAb53HjcUPXwBlEwnOrU70BM51f3l:aKTM3YMtjlvwBDOQ7d5Rl
TLSH
T1E37723137684C46DE16A05319E6F6EA4A2A96C336B2141DBF690FF581CF01D2BE33B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Phish.exe
- Size 33.8MB
- SHA256 fc4fc5613d89e5306b2df299a1ff67d252a94e08ba3dd729379e19aaf0ff671f
- MD5 731d1da6a4c17e1d581554bbe9ed4e47
- SHA1 a428f487d7214e9ee447900ceffdf5ca789c3bdf
- SHA512 3f94f4b0853103c31c008ba005adfe5b39d91c49d079181a8c29482a11d2a1928fc2d18e1b0fc9c0e4bd2670cb1998a6ecc66159894e3fa7e959a114938c266f
- SSDEEP 786432:aKDHMykyFjHAb53HjcUPXwBlEwnOrU70BM51f3l:aKTM3YMtjlvwBDOQ7d5Rl
- TLSH
  T1E37723137684C46DE16A05319E6F6EA4A2A96C336B2141DBF690FF581CF01D2BE33B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor costura defense_evasion discovery packer persistence privilege_escalation ransomware rat revoked_codesign spyware trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2