General
-
Target
Document-1310.iso
-
Size
338KB
-
Sample
220603-peczasegb4
-
MD5
ba10e6e571578304126a889202571e1b
-
SHA1
4a5d5a50503bc96e50b103981f05373982ecf307
-
SHA256
692ad829cb6c9788998acb106ea4d8311e432c866d082ac3cc117166ac50080d
-
SHA512
aa0971e9169786e65407aae13a05b23710abda00c23d5103434ac655183670248a19736153c2528661f6dd7fcf46bc03df2c9264b84e24464aaa7ad916f6c40b
Static task
static1
Behavioral task
behavioral1
Sample
1662.ps1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1662.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Scan_139.jpg.lnk
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Scan_139.jpg.lnk
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
1662.ps1
-
Size
192KB
-
MD5
3f5498ca9c0d3d185bc45edf45185d07
-
SHA1
f945b742489e29dff58fd41a4f6293b6deb57533
-
SHA256
caa1268740d0b48795621f8d0e127fd4574c87de5c16f5348fadc97866d1de39
-
SHA512
34849f297613c9c2b284704e65701aa88ded0ccea1956d55233a052810149b81489c4e7b6bd0416b53d394ec676221527fbe700434756ed04827b5b9bad0334c
Score10/10-
DoubleBack x64 Payload
-
Blocklisted process makes network request
-
Drops file in System32 directory
-
-
-
Target
Scan_139.jpg.lnk
-
Size
1KB
-
MD5
ae4d8e1b3f31028acb611bdefbfa51b2
-
SHA1
6327c8798e529dd479e7bdd99c314867a7cccd3b
-
SHA256
f73826aa0bdf74bc777023b1e2c05fbb79194f81be1c2977af1fcbe6298740ff
-
SHA512
4bc8d72294ee65c89e0a0815321e1d67ae9f3ed43d7dd7aabc3fc05d02c766ff68664873265e3ef01e1fee12807d9b52c218d23d03b0fd91520ab853ea883557
Score8/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-