General
- Target SQL_LogScout_v6.26.01.27_Signed_2.zip
- Size 719KB
- Sample260709-gzbb7sds3r
- SHA256 612d37ab49c0c3cb09df50cde6949b51b98ef4d0967779e70ddcdf05e805c05e
Malware Config
Targets
-
- Target Bin/CleanupIncompleteShutdown.ps1
- Size 30KB
- SHA256 c574b8fe1de165b0034a347ccad6d84a7ad5a5090d9c11edcb644d5ba76bc428
Score3/10 -
- Target Bin/CommonFunctions.psm1
- Size 92KB
- SHA256 2ce7bfec6c3dc987583d1aa862dd70003d123830797a0c443f037726ed7879d4
Score3/10 -
- Target Bin/Confirm-FileAttributes.psm1
- Size 20KB
- SHA256 fe97ef79bca876736a8a5c6ea9ede01ad582015fbfe058eb4972bc68d75e75e6
Score3/10 -
- Target Bin/FindMissingMsiMspFiles.psm1
- Size 62KB
- SHA256 624ba5a65850ebc04285b89524e1596271a28af369e3901ceb55019589415fea
Score3/10 -
- Target Bin/GUIHandler.psm1
- Size 49KB
- SHA256 fa6bfcc5dc76538cec14aa293f9f67170b0652f2163b45194033e73ef9c22f7e
Score3/10 -
- Target Bin/InstanceDiscovery.psm1
- Size 41KB
- SHA256 38b876fc1270edbd7d7389aef74a45b690278a22b38d97e712896faace849a55
Score3/10 -
- Target Bin/LoggingFacility.psm1
- Size 40KB
- SHA256 be07c675c78cfbdd091b6bbf3e0af7a983ceedda28232ec9df2cf9f49c342c1a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Bin/PerfmonCounters.psm1
- Size 20KB
- SHA256 9c96c7b79541f3f9340d538e7b7efdae22b38aa2924d0dbdd032c504138b0b40
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Bin/Readme.htm
- Size 140KB
- SHA256 e7fd6cb65f5ed97f9be512b0f542bdd65ac0527411201be83de3abdfb1fcd1e0
Score4/10 -
- Target Bin/SQLDumpHelper.ps1
- Size 38KB
- SHA256 205031f6a7601b1a3308eaa46aa804655d26910e6ba80ef78e38214eda129266
Score3/10 -
- Target Bin/SQLLogScoutCoreModule.psm1
- Size 364KB
- SHA256 ddb76d48c2ce69f7a666be378d8eb4a994d849627d5ef83c740bd5caae41fa1c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Bin/SQLLogScoutPs.ps1
- Size 49KB
- SHA256 3c23248ca0bce82bde59891129858fd56c838d86f55e98f9d3aca9b8d474f87f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Bin/SQLScript_AlwaysOnDiagScript.psm1
- Size 39KB
- SHA256 17219e7ba63ebbf1e6dd303006d28504e6dee7db36dd7bc836f6b0fc3ff2fbd9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Bin/SQLScript_ChangeDataCapture.psm1
- Size 19KB
- SHA256 69c80012b3678a9840f8b039c9448f06ba2f278180db82eabaf36d566dd2801b
Score3/10 -
- Target Bin/SQLScript_Change_Tracking.psm1
- Size 20KB
- SHA256 9e9a1c0bcc76442c8a54b7e3f260f7f553f0944ee2d8a340356b419f13d3f379
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Bin/SQLScript_FullTextSearchMetadata.psm1
- Size 30KB
- SHA256 da751be989dc07c361e36cb100171594d5f626a3eaa8cabe008745e110fc3624
Score3/10