General
-
Target
2bab5546123fcf539b4498f86aa979ca9db1408384961fef84a82d87a1a1e6b5
-
Size
266KB
-
Sample
201113-a3sdgk9pcn
-
MD5
c1515c8ad9887d0c7b38d048e7e8d76e
-
SHA1
50ef77d312618883cffc85beb66f4a26d09d7688
-
SHA256
2bab5546123fcf539b4498f86aa979ca9db1408384961fef84a82d87a1a1e6b5
-
SHA512
51aff5f1eb82a6a9ae65f22e32a4cf4ad4dabceaac7fc40f25833c3415d9d0b737aa39f1d5a8395458f1944a75a312972dc7627392f520d9712ba04ea472f353
Static task
static1
Behavioral task
behavioral1
Sample
2bab5546123fcf539b4498f86aa979ca9db1408384961fef84a82d87a1a1e6b5.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2bab5546123fcf539b4498f86aa979ca9db1408384961fef84a82d87a1a1e6b5.exe
Resource
win10v20201028
Malware Config
Targets
-
-
Target
2bab5546123fcf539b4498f86aa979ca9db1408384961fef84a82d87a1a1e6b5
-
Size
266KB
-
MD5
c1515c8ad9887d0c7b38d048e7e8d76e
-
SHA1
50ef77d312618883cffc85beb66f4a26d09d7688
-
SHA256
2bab5546123fcf539b4498f86aa979ca9db1408384961fef84a82d87a1a1e6b5
-
SHA512
51aff5f1eb82a6a9ae65f22e32a4cf4ad4dabceaac7fc40f25833c3415d9d0b737aa39f1d5a8395458f1944a75a312972dc7627392f520d9712ba04ea472f353
Score10/10-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-