General
- Target imgui.rar
- Size 1.6MB
- Sample260628-x8bbkacw3s
- SHA256 6b27208703d37dd39e29001feed53845346af208665086ee3eda20a2e088e26f
Score
8/10
Malware Config
Targets
-
- Target libgcc_s_seh-1.dll
- Size 137KB
- SHA256 cf371c6aba2f71b2b95ebbfac8528ec9ccdd082efef2cbac498d56ffb2bb763c
Score1/10 -
- Target libstdc++-6.dll
- Size 2.2MB
- SHA256 3f17805de1ee74a71a0924f0b3e7ceccfa196ec7e96ea6be492ff96ae6950f2f
Score4/10 -
- Target libwinpthread-1.dll
- Size 56KB
- SHA256 7882d1b093714ccdfaf4e0789a8177920a2b812609949dcbcf7937c5618132d8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target openvr_api.dll
- Size 817KB
- SHA256 bab8ac6ef64e68a9ca53315b0014d131088584b2efdfa6db511d67ec03cfcb4a
Score1/10 -
- Target syte.xyz.exe
- Size 1.5MB
- SHA256 0448616b232ee22ef1e86929fe531c48b038d4e32cbcca1c25a7429a5a1a7c84
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.