fa27c238e59bdd68daa638d9b2ef456154d3ac191ace1a4ed327768f9a5fa5f3

General

Target
09092026_1420_09092026_IIRSSSSA20226.CMD.zip
Size 1KB
Sample260909-rnx2yawgrd
SHA256 fa27c238e59bdd68daa638d9b2ef456154d3ac191ace1a4ed327768f9a5fa5f3
MD5 73f81ef85b3e728c5244b7c934a3dd52
SHA1 088085bf0570bb1510e9a3af11a060fccce1cbb9
SHA512 690dca970c7ff4e83f08e27246ca7d3030eb508c726bb70ecc058d9de68fd2ff9e6b469d09e8592e247bc6df549510a5833b82493b981e7877bb2579cd1ee03d
TLSH
T1F011A8B15DF7493CD2F952F10ACD4B19A297AE101199254706F9C75319D3848DD4E270
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  IIRSSSSA20226.CMD
- Size 2KB
- SHA256 fba8e70af882f32731d588d2af057daeffe4b225f4bc1b828944ef0ac4b586ca
- MD5 cafab50b0603aa522833006fe4471e91
- SHA1 7d6f5494d2dff81006b0292b4a7b32202c8743ef
- SHA512 7bc79410c02dcb3822e51ed0436c97bd4a97b9ec3216031884a88050194215deb50d9badae920582c788325b7560a336a8fc517bb548fe63a8e68f49facc30e0
- TLSH
  T16F4121AF01DEE31A9661DB44B69745495D0B9E626129BF9B32EE8812D40D30FB3F8384
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor defense_evasion discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2