Overview

overview

10

Static

static

1

d365_notification.lnk

windows10-2004-x64

10

d365_notification.lnk

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d365_notification.zip
  • Size 20.3MB
  • Sample260707-phkhjshx9v
  • SHA256 b42043f7abdf66112045382f5a6ac886af193bfa9a6ba900087bd8dcff9028d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sliverbackdoordefense_evasionexecutiontrojan

Malware Config

Targets

    • Target
      d365_notification.lnk
    • Size 28.3MB
    • SHA256 25bae396bb0f3a311c390f63cefc4ca3e7163ba0667d9a310c0ef9d677bff08a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordefense_evasionexecutionslivertrojan

    • Family: SliverRAT

      SliverRAT is an open source Adversary Emulation Framework.

      trojanbackdoorsliver

    • Sliver RAT v2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks