hxxps://accounts[.]google[.]com/SignOutOptions?hl=pt-BR&continue=hxxps://www[.]google[.]com/search%3Fq%3DC[:]%255CWindows%255CSystem32%255Crundll32[.]exe%2Bshell32[.]dll,SHCreateLocalServerRunDll%2B%257B9BA05972-F6A8-11CF-A442-00A0C90A8F39%257D%2B-Embedding%26client%3Dchrome-mobile%26sca_esv%3Ddde3a9518543860a%26sxsrf%3DAPpeQnuRJDMb0eqvK7GkVRoWgM7K9aqnhA[:]1785141609544%26udm%3D50%26source%3Dchrome[.]ob%26fbs%3DABfTbFVGaQeaqnsRPI5sOMG32Ksz6cz9h3eVUp5ML7qH5WsxvabC1UUZKx25rNd3fIh5KRrezBnJ85Zvw6Q-Pjs-Mu0VEPfSq_rBI555p7HNl4cQ6d8v11Z0btCy0ME0p9pOD8NOeuMifd_P5ptjbFLzbftqhIvYvWFt39bf_owKbtD4KQwyzL0EMcrZy35RMP62ob1D5cx1bSM-USMc01pQfdYS76vzCM8OTdgJgxISZ22TXvWioZU%26aep%3D1%26ntc%3D1%26cs%3D0%26sa%3DX%26ved%3D2ahUKEwjqxIrcuvKVAxVfErkGHUlSHHgQ2J8OegQIDhAE%26biw%3D384%26bih%3D678%26dpr%3D1[.]88&ec=futura_srp_og_si_72236_p

Sharing

Copy URL Twitter E-mail

General

Target
https://accounts.google.com/SignOutOptions?hl=pt-BR&continue=https://www.google.com/search%3Fq%3DC:%255CWindows%255CSystem32%255Crundll32.exe%2Bshell32.dll,SHCreateLocalServerRunDll%2B%257B9BA05972-F6A8-11CF-A442-00A0C90A8F39%257D%2B-Embedding%26client%3Dchrome-mobile%26sca_esv%3Ddde3a9518543860a%26sxsrf%3DAPpeQnuRJDMb0eqvK7GkVRoWgM7K9aqnhA:1785141609544%26udm%3D50%26source%3Dchrome.ob%26fbs%3DABfTbFVGaQeaqnsRPI5sOMG32Ksz6cz9h3eVUp5ML7qH5WsxvabC1UUZKx25rNd3fIh5KRrezBnJ85Zvw6Q-Pjs-Mu0VEPfSq_rBI555p7HNl4cQ6d8v11Z0btCy0ME0p9pOD8NOeuMifd_P5ptjbFLzbftqhIvYvWFt39bf_owKbtD4KQwyzL0EMcrZy35RMP62ob1D5cx1bSM-USMc01pQfdYS76vzCM8OTdgJgxISZ22TXvWioZU%26aep%3D1%26ntc%3D1%26cs%3D0%26sa%3DX%26ved%3D2ahUKEwjqxIrcuvKVAxVfErkGHUlSHHgQ2J8OegQIDhAE%26biw%3D384%26bih%3D678%26dpr%3D1.88&ec=futura_srp_og_si_72236_p
Sample260810-qgdt2svsdx

Score

8^/10

Malware Config

Targets

- Target
  https://accounts.google.com/SignOutOptions?hl=pt-BR&continue=https://www.google.com/search%3Fq%3DC:%255CWindows%255CSystem32%255Crundll32.exe%2Bshell32.dll,SHCreateLocalServerRunDll%2B%257B9BA05972-F6A8-11CF-A442-00A0C90A8F39%257D%2B-Embedding%26client%3Dchrome-mobile%26sca_esv%3Ddde3a9518543860a%26sxsrf%3DAPpeQnuRJDMb0eqvK7GkVRoWgM7K9aqnhA:1785141609544%26udm%3D50%26source%3Dchrome.ob%26fbs%3DABfTbFVGaQeaqnsRPI5sOMG32Ksz6cz9h3eVUp5ML7qH5WsxvabC1UUZKx25rNd3fIh5KRrezBnJ85Zvw6Q-Pjs-Mu0VEPfSq_rBI555p7HNl4cQ6d8v11Z0btCy0ME0p9pOD8NOeuMifd_P5ptjbFLzbftqhIvYvWFt39bf_owKbtD4KQwyzL0EMcrZy35RMP62ob1D5cx1bSM-USMc01pQfdYS76vzCM8OTdgJgxISZ22TXvWioZU%26aep%3D1%26ntc%3D1%26cs%3D0%26sa%3DX%26ved%3D2ahUKEwjqxIrcuvKVAxVfErkGHUlSHHgQ2J8OegQIDhAE%26biw%3D384%26bih%3D678%26dpr%3D1.88&ec=futura_srp_og_si_72236_p
Score

8^/10

discovery defense_evasion antivm
- Path Permission
  Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
  defense_evasion
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Gatekeeper Bypass
  Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
  defense_evasion
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
  defense_evasion
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9