Overview

overview

8

Static

static

1

URLScan

urlscan

http://jsdkhsdhjkfh

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    http://jsdkhsdhjkfh
  • Sample260804-t54bdsveqa
Score
8/10
command_and_controldefense_evasiondiscoveryspywaretrojan

Malware Config

Targets

    • Target
      http://jsdkhsdhjkfh
    Score
    8/10
    command_and_controldefense_evasiondiscoveryspywaretrojan

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Outbound SSH connection to public host

      SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

      command_and_control

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks