General
- Target d.rar
- Size 210KB
- Sample260709-p35dfsay2m
- SHA256 0f4367f2b69ed6c27d19ee6a5166a3ec8394bca04e55e9399a64825d717e1d3f
Score
8/10
Malware Config
Targets
-
- Target d.rar
- Size 210KB
- SHA256 0f4367f2b69ed6c27d19ee6a5166a3ec8394bca04e55e9399a64825d717e1d3f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
- Target d/d.txt
- Size 37B
- SHA256 38da91a46cde85e22d56135e4884095f158aa02dc01797910bdaa9f69ce73e4e
Score1/10 -
- Target d/daws.txt
- Size 19B
- SHA256 c248e6cc0f1b868e1759fe3421bd97f86f29cf53606dd5f7e957f67d944d0341
Score1/10 -
- Target d/rushwoofer.exe
- Size 705KB
- SHA256 4134cc9bb99e0fceeb02f9e074b1f7fdbba76d1aeec9f76d80e1b12016721b5f
Score6/10-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.