5b6f952455134c505b09dbeab06f29b3dabe42f2caa36ad685f071db1fb3af93

General

Target
Secured_Document.zip
Size 4KB
Sample260909-aksvdaak2x
SHA256 5b6f952455134c505b09dbeab06f29b3dabe42f2caa36ad685f071db1fb3af93
MD5 b8cf932e6b48183e0f2ece5a868269e5
SHA1 e482ffc52d67a0fe4a24864e119204dc30ba94b5
SHA512 58978dae46b6c93ba7161ef4620019008122f0de687df3b1844e7a5e4ce453b03e02099954647f91028ba7512db5eb50bde74f3b2e06c0948bb6296fe0c95f95
SSDEEP 96:c/nX//nUHADsDiHzhMNFqrBA5Zc/nUnKADsDiHzhMNFqrBA51/nUTE/nUkl/nUnU:O6hD2qFqVAvuhD2qFqVAwToz
TLSH
T14E81F702A457848EC93C7BBD911B8A2CF1AD5252F080F453A821AA79788D72F1F5E5B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Zoom_Meeting_Upgrade/Zoom_Meeting_Update.js
- Size 6KB
- SHA256 f6c191a5e82c282ebc828ab75cc7130e08423ef06a36bcaeef731e654047e8e9
- MD5 2b88f0d819782e1496b165b47e49e7ce
- SHA1 3de1d21515584354ba298f40013f9df4f795856b
- SHA512 1a9dbebf155d55f04714d79465a2a305654e9f2c7816b0cb30af56f8bc16c4a0871a0402147ae6f8fb541e548dd741f84a292c47c07080ec1b724496a5b5d3a4
- SSDEEP 48:Hggr/j3gjOsCQ71FC+QifYBMA9IALuHWpCORzAjW4UMbpFqRweDcY/iQLKAXse8m:HgJFDJ+MpS/l3Mb7qmJciEKnnMRpqS
- TLSH
  T10CD13088C9B79A6894676247F31B374837E2A15F1201EAB8B94EC7C6CF087F446583F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Zoom_Meeting_Upgrade/Zoom_Meeting_Upgrade.js
- Size 6KB
- SHA256 f6c191a5e82c282ebc828ab75cc7130e08423ef06a36bcaeef731e654047e8e9
- MD5 2b88f0d819782e1496b165b47e49e7ce
- SHA1 3de1d21515584354ba298f40013f9df4f795856b
- SHA512 1a9dbebf155d55f04714d79465a2a305654e9f2c7816b0cb30af56f8bc16c4a0871a0402147ae6f8fb541e548dd741f84a292c47c07080ec1b724496a5b5d3a4
- SSDEEP 48:Hggr/j3gjOsCQ71FC+QifYBMA9IALuHWpCORzAjW4UMbpFqRweDcY/iQLKAXse8m:HgJFDJ+MpS/l3Mb7qmJciEKnnMRpqS
- TLSH
  T10CD13088C9B79A6894676247F31B374837E2A15F1201EAB8B94EC7C6CF087F446583F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral3 behavioral4