Overview

overview

8

Static

static

8

.exe

windows7_x64

8

.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Release.rar

  • Size

    6.1MB

  • Sample

    210223-bzvba4pd92

  • MD5

    8ea778c7e9ca6673885fb5f0bef885d9

  • SHA1

    0a518415e2998ff43e7649b068eaf6623f7e8046

  • SHA256

    e0d71bb96f69a7709fcd9d0b86897e1d07cdea0494c3be4d00ae047fd90237a4

  • SHA512

    33457622b7d88c7f6f90e599c8ac26fce1e88e0b839f8e49d9115f53e7855c373bc2d474db0b013307ffab5766b20a4e9b6e326f5526a3828c1ce947a26a20af

Score
8/10
evasionvmprotect

Malware Config

Targets

    • Target

      .exe

    • Size

      6.0MB

    • MD5

      425c4a84cdb904690c64acfcb47c7816

    • SHA1

      e6b25f9de8f79563230d54cb3bb93c22ee6f3cbb

    • SHA256

      24f19da01be191513b2f309733f46110d4fa04a5b97d4a057ff10a49b70b2c95

    • SHA512

      7e25bc97873c9f742132995c46aacbb5c24cb7e5fa8422cfa3f3be2dbbae6f45c3bef806d1357352622ad57e394cd9593972197b8695e02afc84f11c5ceed670

    Score
    8/10
    evasion

    • Stops running service(s)

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks