General
- Target Releases (4).zip
- Size 3.4MB
- Sample261024-cf8fda1zex
- SHA256 89da93a1346e3bcd40a3d8f20fae56702f4c1fed51afa032e83319c9d8e3df19
Score
8/10
Malware Config
Targets
-
- Target Extractor.dll
- Size 5.9MB
- SHA256 1227e484f32c34f026f311e60f1abae065e00f203153dbf0623152dedf5cafbd
Score3/10 -
- Target Guna.UI2.dll
- Size 2.1MB
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
Score1/10 -
- Target VirusBuilder.exe
- Size 522KB
- SHA256 cf4b1f40d6d51aff94cdab689e598a3d419e4dc1cbf194d92a545ad20c4d1900
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Modifies system executable filetype association
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1