General
-
Target
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9
-
Size
212KB
-
Sample
220612-ex3mkaebbk
-
MD5
0c4a0a1d43bc8a7c69fa423ea2923a9f
-
SHA1
fb2b154989c6fb8b6a9d9b10eb59999f5e84ce8d
-
SHA256
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9
-
SHA512
d7060323e4a1e1366a367573a387caba66a7eb3a95b9a305461d27043beb634c101e70dda6d61b47b54e751582cb80f843b4ecaeaeca8382a3d605dca52b418b
Static task
static1
Behavioral task
behavioral1
Sample
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
tofsee
103.232.222.57
111.121.193.242
123.249.0.22
Targets
-
-
Target
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9
-
Size
212KB
-
MD5
0c4a0a1d43bc8a7c69fa423ea2923a9f
-
SHA1
fb2b154989c6fb8b6a9d9b10eb59999f5e84ce8d
-
SHA256
22b4777ab2a1d8aae71860eecab96c2fdcc6738c22536f4ff68e7c250ac1c8c9
-
SHA512
d7060323e4a1e1366a367573a387caba66a7eb3a95b9a305461d27043beb634c101e70dda6d61b47b54e751582cb80f843b4ecaeaeca8382a3d605dca52b418b
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-