General
- Target rat.exe
- Size 771KB
- Sample260625-tkpmhac18v
- SHA256 ee1fe2a667161db925e674f9f1c153cb1f358301595294775d169afde0c2eec5
Score
10/10
Malware Config
Targets
-
- Target rat.exe
- Size 771KB
- SHA256 ee1fe2a667161db925e674f9f1c153cb1f358301595294775d169afde0c2eec5
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Turns off Windows Defender SpyNet reporting
-
Windows security bypass
-
Modifies Windows Firewall
-
Windows security modification
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1