General
-
Target
35c35175c681c805e8b12413243324b24573f63533d649f0d88e2b8b58b90182
-
Size
121KB
-
Sample
220626-25el2aebcj
-
MD5
dccd504e5e44c162e8461ad9ad286ee3
-
SHA1
e2a68b76db070380809754b7a0fa1cf8a0786f27
-
SHA256
35c35175c681c805e8b12413243324b24573f63533d649f0d88e2b8b58b90182
-
SHA512
b52b884420af198361ee650ca61ee9b64463b89469d0d54c8a00c06cdf27ff201ecd6262c3dc3cb959d487c8040e2e3d993f8fc09e8f59bf8c5e74119a69ff04
Static task
static1
Behavioral task
behavioral1
Sample
35c35175c681c805e8b12413243324b24573f63533d649f0d88e2b8b58b90182.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
35c35175c681c805e8b12413243324b24573f63533d649f0d88e2b8b58b90182.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
35c35175c681c805e8b12413243324b24573f63533d649f0d88e2b8b58b90182
-
Size
121KB
-
MD5
dccd504e5e44c162e8461ad9ad286ee3
-
SHA1
e2a68b76db070380809754b7a0fa1cf8a0786f27
-
SHA256
35c35175c681c805e8b12413243324b24573f63533d649f0d88e2b8b58b90182
-
SHA512
b52b884420af198361ee650ca61ee9b64463b89469d0d54c8a00c06cdf27ff201ecd6262c3dc3cb959d487c8040e2e3d993f8fc09e8f59bf8c5e74119a69ff04
Score10/10-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-