General
-
Target
4c536a8728b5a2207332856d9aea7be3be41f0b2a921c049a73894e371ca6cb0
-
Size
341KB
-
Sample
220625-j56fmsehe3
-
MD5
c8a7a319ce6c507a8fa2b90c201c728e
-
SHA1
d0683f663b502598c4f2c543cb1c2554eebd6e61
-
SHA256
4c536a8728b5a2207332856d9aea7be3be41f0b2a921c049a73894e371ca6cb0
-
SHA512
98c46849126cf94a3a9ac7c0c7e6525f44e2b46b77d6700e7c0adc61054b78f9cdc3d7bddecaf1ed4922d5f5af8c0426396ee26dcb31970225523118666864fc
Static task
static1
Behavioral task
behavioral1
Sample
4c536a8728b5a2207332856d9aea7be3be41f0b2a921c049a73894e371ca6cb0.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4c536a8728b5a2207332856d9aea7be3be41f0b2a921c049a73894e371ca6cb0.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
4c536a8728b5a2207332856d9aea7be3be41f0b2a921c049a73894e371ca6cb0
-
Size
341KB
-
MD5
c8a7a319ce6c507a8fa2b90c201c728e
-
SHA1
d0683f663b502598c4f2c543cb1c2554eebd6e61
-
SHA256
4c536a8728b5a2207332856d9aea7be3be41f0b2a921c049a73894e371ca6cb0
-
SHA512
98c46849126cf94a3a9ac7c0c7e6525f44e2b46b77d6700e7c0adc61054b78f9cdc3d7bddecaf1ed4922d5f5af8c0426396ee26dcb31970225523118666864fc
Score10/10-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-