General
- Target loader.zip
- Size 3.8MB
- Sample261027-w97kqaec56
- SHA256 265d73e614e111034332d03d60a5285d6e21e15c599756d8ae6b2a79e6418626
Score
8/10
Malware Config
Targets
-
- Target auth\O4bL6Cpwn4kO
- Size 131.8MB
- SHA256 f200923165a6510508964000f305df45a00bc079f3eb97dcd14ca94ae0cd0dd5
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target loader.exe
- Size 4.5MB
- SHA256 66a1f6ccc9f869945bec8149f1af5ce5bb587d3d25c8008cfdc0bf3c0cebf9c2
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application
-
- Target vcruntime140.dll
- Size 116KB
- SHA256 f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
Score1/10 -
- Target version.dll
- Size 124KB
- SHA256 00f6b47ed70472f6b7cf95b8cdeb33d254906d780148df205320a0f7d25298e4
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1