Overview

overview

10

Static

static

3

causativenesszb.exe

windows7-x64

10

causativenesszb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    causativenesszb.exe

  • Size

    181KB

  • Sample

    240601-x9h3ssdd93

  • MD5

    0d9f4b56d3f36373f8bf26e8107100b0

  • SHA1

    8516094991d5fe0a4c2cec90e9f54833f1d0a326

  • SHA256

    a6b5435b16903b2c557210a813fdfacc9d4b965d01b05a46a3d2b6c353719e05

  • SHA512

    a313b0219d5248f9995f3b2f70bf30e8e9cf528659e98a4cb53b3ffdc80d1b0c9ee03cc3bc6d3bed36d31801506200a1188c849f551d401b725bd009f6e91c20

  • SSDEEP

    3072:3CmlA+2TGMF85+bkRG32foUP9GmPe97UoSs1urv9zHKipsK/huffqeNntqpKRnHV:SmlV4h8JG3QUzSOwzH6K/hC9tqp6HhNZ

Score
10/10
koiloaderloader

Malware Config

Extracted

Family

koiloader

C2

http://195.123.224.66/marasmus.php

Attributes
  • payload_url

    https://www.dsestimation.com/wp-content/uploads/2015/10

Targets

    • Target

      causativenesszb.exe

    • Size

      181KB

    • MD5

      0d9f4b56d3f36373f8bf26e8107100b0

    • SHA1

      8516094991d5fe0a4c2cec90e9f54833f1d0a326

    • SHA256

      a6b5435b16903b2c557210a813fdfacc9d4b965d01b05a46a3d2b6c353719e05

    • SHA512

      a313b0219d5248f9995f3b2f70bf30e8e9cf528659e98a4cb53b3ffdc80d1b0c9ee03cc3bc6d3bed36d31801506200a1188c849f551d401b725bd009f6e91c20

    • SSDEEP

      3072:3CmlA+2TGMF85+bkRG32foUP9GmPe97UoSs1urv9zHKipsK/huffqeNntqpKRnHV:SmlV4h8JG3QUzSOwzH6K/hC9tqp6HhNZ

    Score
    10/10
    koiloaderloader
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks