Managed XDR

vtdl_r5ye_ggx — malware analysis report

File info

Filename
vtdl_r5ye_ggx
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has command line arguments, Icon number=18, Archive, ctime=Sat Jul 16 13:18:09 2016, mtime=Sat Jul 16 13:18:09 2016, atime=Sat Jul 16 13:18:09 2016, length=202752, window=hidenormalshowminimized
File size
3.4 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
3601b4d143690480c7d34cd7b139b593a6c4a308
SHA256
7050523fae3b457eeb78596718305d4de62e309e1bd8cd7026c4b46f34d27733
MD5
969469a05db53f9d6e4a0fae2a548ad5

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1047 has_wmi: Executes one or several WMI requests
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Defense Evasion

T1218 suspicious_cmdline: Executes a suspicious command

Discovery

T1082 has_wmi: Executes one or several WMI requests

Command and Control

T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

suspicious_process_network: Unusual process network activity detected
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process
test_check_service: Starts services