General
- Target http://anydesk
- Sample260718-ezheeags5p
Malware Config
Targets
-
- Target http://anydesk
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Modifies Windows Firewall
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Deobfuscate/Decode Files or Information
Payload decoded via CertUtil.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Deobfuscate/Decode Files or Information
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1