General
- Target Obhod_Full.exe
- Size 31.5MB
- Sample261011-sdblmawy5r
- SHA256 865918c46c7d8275411ffd0a8f1e7691ed1baaadaa9a28711a357b61d940711e
Score
10/10
Malware Config
Targets
-
- Target Obhod_Full.exe
- Size 31.5MB
- SHA256 865918c46c7d8275411ffd0a8f1e7691ed1baaadaa9a28711a357b61d940711e
Score10/10-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Windows security bypass
-
XMRig Miner payload
-
Modifies Windows Firewall
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Executes dropped EXE
-
Windows security modification
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1