General
-
Target
3546db46d605f744a285fe60fcbacc6b686aa6fae4c32890b030924471e0e59f
-
Size
99KB
-
Sample
220619-wvq97agaep
-
MD5
2b126fbd0352c9ec2f7833af3d0df7ca
-
SHA1
3bf9cee470ad6cf126635570d89d9d9f30cef386
-
SHA256
3546db46d605f744a285fe60fcbacc6b686aa6fae4c32890b030924471e0e59f
-
SHA512
0dfb908197503bf9c1c9deeb015504d1b51d4c00857b34c3862f6c7fd9a4423acb0a068f1b63e2d6757b4c89f2d993e7913767c24d32763afd5e3c1ec43bdcc7
Static task
static1
Behavioral task
behavioral1
Sample
3546db46d605f744a285fe60fcbacc6b686aa6fae4c32890b030924471e0e59f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3546db46d605f744a285fe60fcbacc6b686aa6fae4c32890b030924471e0e59f.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
3546db46d605f744a285fe60fcbacc6b686aa6fae4c32890b030924471e0e59f
-
Size
99KB
-
MD5
2b126fbd0352c9ec2f7833af3d0df7ca
-
SHA1
3bf9cee470ad6cf126635570d89d9d9f30cef386
-
SHA256
3546db46d605f744a285fe60fcbacc6b686aa6fae4c32890b030924471e0e59f
-
SHA512
0dfb908197503bf9c1c9deeb015504d1b51d4c00857b34c3862f6c7fd9a4423acb0a068f1b63e2d6757b4c89f2d993e7913767c24d32763afd5e3c1ec43bdcc7
Score10/10-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-