Managed XDR

vtdl_srfsw2a0 — malware analysis report

File info

Filename
vtdl_srfsw2a0
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has command line arguments, Icon number=3, Archive, ctime=Sat Nov 20 21:29:12 2010, mtime=Sat Nov 20 21:29:12 2010, atime=Sat Nov 20 21:29:12 2010, length=302592, window=hidenormalshowminimized
File size
1.8 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
6cc831de6540314de81d6c1216ee2133496401a6
SHA256
678c79de533019c5e0dc905b192e7ff44276a9438a4cf34b8928f625d3387911
MD5
c0c9f5526cf7ed192b7fcfa899bb0dae

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1036 copies_utilities: Copies and runs system utility with different name
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1552.001 infostealer_bitcoin: Attempts to obtain access to Bitcoin/ALTCoin wallets

Other

creates_exe: Creates executable files in the file system
executes_dropped_exe: Executes dropped exe files
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
test_check_service: Starts services
yara_rules: Static rules