Overview

overview

8

Static

static

1

run.bat

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    New folder.zip
  • Size 9.9MB
  • Sample260818-srce3sdj8z
  • SHA256 ff82b8abb264c0ad42bbc4b497ec1a5e3a34e56294b90ec389c8da8bc490c8a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistencespyware

Malware Config

Targets

    • Target
      run.bat
    • Size 46B
    • SHA256 5224c0bd9c67ea4cd1a1f758e03f2ca4c299558de6d575ecb314e9e7d5cdf0a6
    • MD5 SHA1 SHA512
    Score
    8/10
    executionpersistencespyware

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks