General
- Target ExtremeLoader.zip
- Size 5.3MB
- Sample261107-12e8qavyd1
- SHA256 207de7878b49bf4ebcd9bc12ecf19ce82ba3c6073a91b893e2027a17ff75017c
Score
10/10
Malware Config
Targets
-
- Target ExtremeLoader/666sysEmx.exe
- Size 3.2MB
- SHA256 36bf0456c4678928371a6e0c6c0472c2da182fbc0055c8b04f2cb6bc30c975c0
Score10/10UAC bypass
Checks whether UAC is enabled
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
Executes a VBScript file via the Windows Script Host.
-
- Target ExtremeLoader/extremeui.exe
- Size 2.1MB
- SHA256 dd725418f891cd4b0d9e8afc844c205e09b3180b33cae53ef262f79157db5327
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
2