General
- Target poopy fart.zip
- Size 3.2MB
- Sample260901-29v5kstshs
- SHA256 d69c2f2f50b9b965a96df33c6f8cf35ae5ff8a202192f9dcfc3ca3cd68b13a0f
Score
7/10
Malware Config
Targets
-
- Target keihubaudit/META-INF/jars/Java-WebSocket-1.5.3.jar
- Size 131KB
- SHA256 ce16d6e9e7bce0bdf4cd17e2ed76c125b63aa28c8b30cba12484f17ff0687573
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
- Target keihubaudit/META-INF/jars/opus-java-api-1.1.1.jar
- Size 11KB
- SHA256 be9c73e4932f75e09e0ce8ab405437ec23aeea6816b4377c041130a11d8ee6bc
Score1/10 -
- Target keihubaudit/META-INF/jars/opus-java-natives-1.1.1.jar
- Size 2.2MB
- SHA256 36cbc81cd6930e57ea15a004451368c0068f1c4c438ab83a21d5a1b2edc78452
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1