Overview

overview

8

Static

static

chthonic_2...ir.exe

windows7_x64

chthonic_2...ir.exe

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    chthonic_2.23.18.27.vir

  • Size

    848KB

  • Sample

    200719-7x36jp44cs

  • MD5

    652ddd26bb95583bfceddba3f0813b9a

  • SHA1

    1ff3e9c230a345813b0848d911d80e2150b2df10

  • SHA256

    f4dfc047ed766b96a6de718ea96fefee921556caa4ce6171fbe407284cbba2f3

  • SHA512

    47cbbdce287047f7641c091e818c150c5de44f9ee6adee89c73b35d6b3b5d4feb8a1e49e1298768bf5831b489b025827b1ac25711f3da1de280d0c735da983da

Score
8/10
bootkitpersistenceransomware

Malware Config

Targets

    • Target

      chthonic_2.23.18.27.vir

    • Size

      848KB

    • MD5

      652ddd26bb95583bfceddba3f0813b9a

    • SHA1

      1ff3e9c230a345813b0848d911d80e2150b2df10

    • SHA256

      f4dfc047ed766b96a6de718ea96fefee921556caa4ce6171fbe407284cbba2f3

    • SHA512

      47cbbdce287047f7641c091e818c150c5de44f9ee6adee89c73b35d6b3b5d4feb8a1e49e1298768bf5831b489b025827b1ac25711f3da1de280d0c735da983da

    Score
    8/10
    persistenceransomwarebootkit

    • Modifies WinLogon to allow AutoLogon

      Enables rebooting of the machine without requiring login credentials.

      ransomwarebootkit

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks