General
-
Target
5da182f87ce347d700cb2d9d4564bd4c91d74cd77ad831f51971b98c21f290f3
-
Size
626KB
-
Sample
210511-f4vhcxnbkn
-
MD5
da39fc66d5446f0a4805ae5784a2384b
-
SHA1
96913280127b559ae0c8a62a8f802e892b7dedc4
-
SHA256
5da182f87ce347d700cb2d9d4564bd4c91d74cd77ad831f51971b98c21f290f3
-
SHA512
afd786859a7522aaab1f6a688b3d395d4f657a3439a98370b9eb6eef632b664369ff737617b3223537eb26ce1cda47647c49a87f488393e988a00ff8d5e0c830
Static task
static1
Behavioral task
behavioral1
Sample
5da182f87ce347d700cb2d9d4564bd4c91d74cd77ad831f51971b98c21f290f3.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
5da182f87ce347d700cb2d9d4564bd4c91d74cd77ad831f51971b98c21f290f3.exe
Resource
win10v20210410
Malware Config
Targets
-
-
Target
5da182f87ce347d700cb2d9d4564bd4c91d74cd77ad831f51971b98c21f290f3
-
Size
626KB
-
MD5
da39fc66d5446f0a4805ae5784a2384b
-
SHA1
96913280127b559ae0c8a62a8f802e892b7dedc4
-
SHA256
5da182f87ce347d700cb2d9d4564bd4c91d74cd77ad831f51971b98c21f290f3
-
SHA512
afd786859a7522aaab1f6a688b3d395d4f657a3439a98370b9eb6eef632b664369ff737617b3223537eb26ce1cda47647c49a87f488393e988a00ff8d5e0c830
Score10/10-
Modifies WinLogon for persistence
-
Modifies visibility of file extensions in Explorer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-