General
- Target 6752eE8D090642.zip
- Size 1.5MB
- Sample260805-rwf4dsbf48
- SHA256 dcdc3e89ee36411e1866e09600920323eded9f4156585400dc7bf0e3ebde576b
Score
7/10
Malware Config
Targets
-
- Target Q88 with vessel's particulars.exe
- Size 1009KB
- SHA256 151b01ecbb7aca8b8a3e82f2e74c4f496e95046b89601a2482e6dcb3d570d78c
Score7/10-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2