Extracted

• • Target
    沈阳地铁官方网站运维使用手册v1.4(北京晨阳科技有限公司2023年9月制v1.4) .pdf.exe
  • Size 3.0MB
  • SHA256 5ff753b070e7f44223920d9f2b33db3c99875b2b9d442469275521ce9ff7a5cb
  • MD5 b0df398b5457a15972b2625d16a21319
  • SHA1 ad73664da1df1e031d4771085a366bdf8dde8caa
  • SHA512 e4c8d2bb80c15ec9a0091b6336e451cd1bec98e491a9638b3a0e6571ed992cb393a3ce0a17b23ddb219f42045deffe2019094b2d0eda1ebd85424e6be1017a8c
  • SSDEEP 49152:U2t9j0oqDVcwzAa6EINWbqccbB5Vmaa2HCxYcjMY:U27N0v
  • TLSH
    T152E58D03FCA12AE6C46E62314D769192BB72BC442F3123DB2A90B7782F72BD05DB5754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoveryexecutioncobaltstrikepersistenceransomwarespywaretrojan

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2