Managed XDR

vtdl_r93a7ggk — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
vtdl_r93a7ggk
Тип файла
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=322, Archive, ctime=Fri Jul 10 10:59:58 2015, mtime=Fri Jul 10 10:59:58 2015, atime=Fri Jul 10 10:59:58 2015, length=74240, window=hide
Размер файла
2.3 KB
Первое обнаружение
Последнее обнаружение

Окружение

win7/x86 en

Хеши

SHA1
d12e6f4f9437caafca586ed34d087991609e09d1
SHA256
b21c5d950a9fafefd9fbc229e091852649c9256a2dc461f67cdbe1758ecd8888
MD5
23396e2a23572908cd415fb787563bbe

Сигнатуры

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup

Defense Evasion

T1218 suspicious_cmdline: Executes a suspicious command

Other

yara_rules: Static rules
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process