General
- Target Program.zip
- Size 486KB
- Sample260703-pfjs8sgy4v
- SHA256 33764391e65763065efc160be505c97fe8c927f8c5064c6f6cfd89f3e72cf597
Score
8/10
Malware Config
Targets
-
- Target Launcher.bat
- Size 2KB
- SHA256 d7fe7246f347ff6cf080246d189f24f9603499d6e34e0c35fa0ec7d21359dbd9
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target conf.txt
- Size 232KB
- SHA256 4b1ba932f06251267820b1af5f0a533f869e809bb9c6a1729a8097553d2f874e
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target lua.exe
- Size 89KB
- SHA256 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
Score3/10 -
- Target lua51.dll
- Size 592KB
- SHA256 ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
Score3/10