General
- Target [Crocky] InjWare (NewUI).zip
- Size 388KB
- Sample260714-akfj2sc15w
- SHA256 6ae774f3ca39c06439f006f742750c9b5d7cabccc48ea2b685f321110c342d2c
Score
8/10
Malware Config
Targets
-
- Target [Crocky] InjWare (NewUI).zip
- Size 388KB
- SHA256 6ae774f3ca39c06439f006f742750c9b5d7cabccc48ea2b685f321110c342d2c
Score1/10 -
- Target CROCKY.txt
- Size 21B
- SHA256 29a106b85b96e82583e4180ac77252fd1383819d1cb2c3a091a686c8de34bf4f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target README.txt
- Size 79B
- SHA256 706998679277211c1357d9872857953b5de5003387d291a82cae5b5ed5d67b60
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target imgui.ini
- Size 53B
- SHA256 1e21059a351147e54cfdaca82ed646444088932581ca4b6fac73152495367f13
Score1/10 -
- Target injware.exe
- Size 767KB
- SHA256 05d1db1081821ac35accb8720943421e1d59fe696881ead274adc4c04632cd76
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger