General
-
Target
962581f03da790ea95f491ef6e35ee153e9dd6d0eb747ea4c87751055bfa2d7e
-
Size
389KB
-
Sample
220630-vey5esefg8
-
MD5
d273c19060deb3a5ae75a440955a8522
-
SHA1
605d95c1eaa7e2e439c154075f96cc4d34d0d082
-
SHA256
962581f03da790ea95f491ef6e35ee153e9dd6d0eb747ea4c87751055bfa2d7e
-
SHA512
3371db70647a629ee8f8bf5eb466bcf6f1a8d3fe21e567c614b8b96029b9d1766ca0790d9dfc3e85cf2b81ad2c089f7c0516913183edc7a9f8c0a1b32edf9a24
Static task
static1
Behavioral task
behavioral1
Sample
962581f03da790ea95f491ef6e35ee153e9dd6d0eb747ea4c87751055bfa2d7e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
962581f03da790ea95f491ef6e35ee153e9dd6d0eb747ea4c87751055bfa2d7e.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
962581f03da790ea95f491ef6e35ee153e9dd6d0eb747ea4c87751055bfa2d7e
-
Size
389KB
-
MD5
d273c19060deb3a5ae75a440955a8522
-
SHA1
605d95c1eaa7e2e439c154075f96cc4d34d0d082
-
SHA256
962581f03da790ea95f491ef6e35ee153e9dd6d0eb747ea4c87751055bfa2d7e
-
SHA512
3371db70647a629ee8f8bf5eb466bcf6f1a8d3fe21e567c614b8b96029b9d1766ca0790d9dfc3e85cf2b81ad2c089f7c0516913183edc7a9f8c0a1b32edf9a24
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-