General
- Target okitas-hub-165.zip
- Size 207.7MB
- Sample260815-wda7ms1xbs
- SHA256 b9a982a250a9b56ef7c90046fee9e02d2b42375671556cbc114dfe976690c5ec
Score
8/10
Malware Config
Targets
-
- Target Okita's Hub/okitas_takeover.exe
- Size 103.8MB
- SHA256 e6b801738a75d25626c433ce1c3518cbd1b183301efd18cac6715d3788fcf479
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Okita's Hub/updater.exe
- Size 36.6MB
- SHA256 4fc3a18ff8e7316e055bdaca2c5c4ff936dab66103d8eadaea597233b4518d95
Score7/10-
Loads dropped DLL
-
- Target Okita's Hub/x_agent.exe
- Size 61.6MB
- SHA256 b4b95618ff329c3c49e222713541a5d627a3e74f7f4e9d185364c8ba48aa8fa2
Score8/10-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Loads dropped DLL
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1