General
- Target protected.zip
- Size 47.9MB
- Sample260808-tqg5lsed36
- SHA256 8a95e99213083931f87b2125f1831036508f430a129e16122b3172204c22eab5
Score
8/10
Malware Config
Targets
-
- Target protected/Slinky.exe
- Size 6.0MB
- SHA256 3d68c709fb63cc90a01d3aaf2db427edf5c39cbfe42a0499090ce7c3ca67827d
Score1/10 -
- Target protected/archive/lib_win
- Size 21.6MB
- SHA256 be03bbecbf14b03458de36c8b3848c1b7325ad0aeb6a61b6e0f9206fc40b4af7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target protected/archive/loader3_win
- Size 6.0MB
- SHA256 f93345c0cfe60e5fce7d8d84ad23043cfcdd2c9516791309215bc9a005ee4e95
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target protected/nacre_7f2c.dll
- Size 8.8MB
- SHA256 044f64c5a19e365b9994e862d710ec37aca8475ddb64270238b16e988257f8e1
Score1/10 -
- Target protected/stinky.exe
- Size 23.0MB
- SHA256 4fb030b137047c127b134051efb187c44b4fc13308cbb8c0dfb94de2627094ae
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger