General
-
Target
10230ffb08bcad488b7b316a9eb55a556ce66f468c1ad40b739432c159a8d30a
-
Size
216KB
-
Sample
220604-qmphqshab5
-
MD5
8505936955f4b5fd5b6844f914abd3ad
-
SHA1
6cb392462d5f5a84ebdec75f4c3630ecf8b71b6e
-
SHA256
10230ffb08bcad488b7b316a9eb55a556ce66f468c1ad40b739432c159a8d30a
-
SHA512
f06a690b9f638a79410db6d5a08b444f16da3515d2b6cbbd78e826ed38136a4a4a242359909970464f5c928b0773b341cc8917aabf788d9b34065e0a8614fa4f
Static task
static1
Behavioral task
behavioral1
Sample
10230ffb08bcad488b7b316a9eb55a556ce66f468c1ad40b739432c159a8d30a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
10230ffb08bcad488b7b316a9eb55a556ce66f468c1ad40b739432c159a8d30a.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
tofsee
103.232.222.57
111.121.193.242
123.249.0.22
Targets
-
-
Target
10230ffb08bcad488b7b316a9eb55a556ce66f468c1ad40b739432c159a8d30a
-
Size
216KB
-
MD5
8505936955f4b5fd5b6844f914abd3ad
-
SHA1
6cb392462d5f5a84ebdec75f4c3630ecf8b71b6e
-
SHA256
10230ffb08bcad488b7b316a9eb55a556ce66f468c1ad40b739432c159a8d30a
-
SHA512
f06a690b9f638a79410db6d5a08b444f16da3515d2b6cbbd78e826ed38136a4a4a242359909970464f5c928b0773b341cc8917aabf788d9b34065e0a8614fa4f
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-