4438516d5ebdb513ccec64667bee1e93290cb5b59088e5a047174418e875c962

Sharing

Copy URL Twitter E-mail

General

Target
4438516d5ebdb513ccec64667bee1e93290cb5b59088e5a047174418e875c962
Size 29KB
Sample260818-jp87lagb27
SHA256 4438516d5ebdb513ccec64667bee1e93290cb5b59088e5a047174418e875c962
MD5 2dff8ddec74ce6df20273b55ec9f2c31
SHA1 b2acd05139230f100f707f9c69103522414121f8
SHA512 4d308079479146534d9ded6d3210965bd8198cf299391964e669534269169c9cfa6de9c749a16c363e41c9f70a6f41cee9130db0db1a9987ada2ffa6d89c6a02
SSDEEP 768:xhrXqBeBfljWa1T+SMhrXqBeBfljWa1T+S3hrXqBeBfljWa1T+SM:xRqBeOaeRqBeOahRqBeOa6
TLSH
T1A7D2B60BFD056635EB52C3F2622B495BE7A5172B84000070BACD84192F5673DEBDE2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  4438516d5ebdb513ccec64667bee1e93290cb5b59088e5a047174418e875c962
- Size 29KB
- SHA256 4438516d5ebdb513ccec64667bee1e93290cb5b59088e5a047174418e875c962
- MD5 2dff8ddec74ce6df20273b55ec9f2c31
- SHA1 b2acd05139230f100f707f9c69103522414121f8
- SHA512 4d308079479146534d9ded6d3210965bd8198cf299391964e669534269169c9cfa6de9c749a16c363e41c9f70a6f41cee9130db0db1a9987ada2ffa6d89c6a02
- SSDEEP 768:xhrXqBeBfljWa1T+SMhrXqBeBfljWa1T+S3hrXqBeBfljWa1T+SM:xRqBeOaeRqBeOahRqBeOa6
- TLSH
  T1A7D2B60BFD056635EB52C3F2622B495BE7A5172B84000070BACD84192F5673DEBDE2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  EXCEL.vbs
- Size 9KB
- SHA256 2e021fc2b1b8543dc7f17c45089705b581d7546e1d2fe4464c09a018a61cc67e
- MD5 a048bf77bd24c520f7eaa93afd7cc990
- SHA1 7464d86993f06767853f5dae1881a4e5fb2742f3
- SHA512 4d835a72ea5d64339c6a945b0f75158cd479eedc08a70068eaa807707a6815364ec0dc090bc300e5fc650233718d0f242921aed40479a619a905a64af4ff1728
- SSDEEP 192:sUu3lwd8KCyxcniJxLGhv71bTkt93StcnxDZQcmId1fWIlACbj1rRcrUV1T+SFn:Th4iJxqhjtTktscXfljWa1T+Sd
- TLSH
  T15522B70FFD056639AB52C3E2622B495BE7A51B1B84400070BACD80153F5673DEBDE2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  PDF.vbs
- Size 9KB
- SHA256 2e021fc2b1b8543dc7f17c45089705b581d7546e1d2fe4464c09a018a61cc67e
- MD5 a048bf77bd24c520f7eaa93afd7cc990
- SHA1 7464d86993f06767853f5dae1881a4e5fb2742f3
- SHA512 4d835a72ea5d64339c6a945b0f75158cd479eedc08a70068eaa807707a6815364ec0dc090bc300e5fc650233718d0f242921aed40479a619a905a64af4ff1728
- SSDEEP 192:sUu3lwd8KCyxcniJxLGhv71bTkt93StcnxDZQcmId1fWIlACbj1rRcrUV1T+SFn:Th4iJxqhjtTktscXfljWa1T+Sd
- TLSH
  T15522B70FFD056639AB52C3E2622B495BE7A51B1B84400070BACD80153F5673DEBDE2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  WORDDOCUMENT.vbs
- Size 9KB
- SHA256 2e021fc2b1b8543dc7f17c45089705b581d7546e1d2fe4464c09a018a61cc67e
- MD5 a048bf77bd24c520f7eaa93afd7cc990
- SHA1 7464d86993f06767853f5dae1881a4e5fb2742f3
- SHA512 4d835a72ea5d64339c6a945b0f75158cd479eedc08a70068eaa807707a6815364ec0dc090bc300e5fc650233718d0f242921aed40479a619a905a64af4ff1728
- SSDEEP 192:sUu3lwd8KCyxcniJxLGhv71bTkt93StcnxDZQcmId1fWIlACbj1rRcrUV1T+SFn:Th4iJxqhjtTktscXfljWa1T+Sd
- TLSH
  T15522B70FFD056639AB52C3E2622B495BE7A51B1B84400070BACD80153F5673DEBDE2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8