General
- Target a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.zip
- Size 2.8MB
- Sample260711-w2n4eaay7s
- SHA256 b59f3cd9b6ab7601cc868d9b1fe96905c6aafe0ebbe1b4d1ad12a20e28b0e462
Score
8/10
Malware Config
Targets
-
- Target a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7
- Size 6.2MB
- SHA256 a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Start PowerShell.
-
Creates new service(s)
-
Drops startup file
-
Executes dropped EXE
-
Stops running service(s)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Modify Registry
1