Overview

overview

8

Static

static

murofet_0....ir.exe

windows7_x64

8

murofet_0....ir.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    murofet_0.0.0.5.vir

  • Size

    160KB

  • Sample

    200719-e36ckqgk32

  • MD5

    a6b4b6bb07cf1e7dd6e352f98b07a872

  • SHA1

    b9c25407e93420b4cdce9b5f8d2a971038aee47a

  • SHA256

    8c9087b9e6af76699ab0777535b2e99c4a345f6d4714953604367adfc4a8f7c1

  • SHA512

    d4e05f52b1c818950e404622539d2b7655d9d392aa101a9cf955c3c0f6d030748f224dbf8e946492b04c3218e96ade51f3a83fe0521f65cb8b0eae2ff899204f

Score
8/10
persistence

Malware Config

Targets

    • Target

      murofet_0.0.0.5.vir

    • Size

      160KB

    • MD5

      a6b4b6bb07cf1e7dd6e352f98b07a872

    • SHA1

      b9c25407e93420b4cdce9b5f8d2a971038aee47a

    • SHA256

      8c9087b9e6af76699ab0777535b2e99c4a345f6d4714953604367adfc4a8f7c1

    • SHA512

      d4e05f52b1c818950e404622539d2b7655d9d392aa101a9cf955c3c0f6d030748f224dbf8e946492b04c3218e96ade51f3a83fe0521f65cb8b0eae2ff899204f

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks