General

  • Target
    ledger-live-desktop-2.70.0-win-x64-setup.exe
  • Size 183KB
  • Sample260717-jrwdhsat31
  • SHA256 26995b5c116da8bc55341e3b16ce6efaf263058e2938b3e416507ffd1b5ab103
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      ledger-live-desktop-2.70.0-win-x64-setup.exe
    • Size 183KB
    • SHA256 26995b5c116da8bc55341e3b16ce6efaf263058e2938b3e416507ffd1b5ab103
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Detects Havoc payload

    • Family: Havoc, HavocC2

      Havoc is an open-source backdoor and post-exploitation framework written in C++.

    • Windows security bypass

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks