Overview

overview

10

Static

static

3

fe5a253088...a6.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    fe5a253088fd5cb618853dc77dc81809b1719ef967c4fdb6f9223fcefef928a6
  • Size 294KB
  • Sample260831-ltejws11ct
  • SHA256 fe5a253088fd5cb618853dc77dc81809b1719ef967c4fdb6f9223fcefef928a6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
citadelbotnetdiscoveryexecutionpersistencetrojan

Malware Config

Targets

    • Target
      fe5a253088fd5cb618853dc77dc81809b1719ef967c4fdb6f9223fcefef928a6
    • Size 294KB
    • SHA256 fe5a253088fd5cb618853dc77dc81809b1719ef967c4fdb6f9223fcefef928a6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    botnetdiscoveryexecutioncitadelpersistencetrojan

    • Detects Citadel payload

    • Family: Citadel

      Citadel is a trojan and botnet written in C.

      trojanbotnetcitadel

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks