General
-
Target
58fdd32be6dcc694fd1a4deeb0ca7b50affa5e8e654cc0dcf9c7ec043ab11cf8
-
Size
608KB
-
Sample
220724-gktv1ahfa7
-
MD5
588a1b9290a66ba12d1f3494d12f4286
-
SHA1
71f946f8e3728af3d6ab4065adb7698c0a902037
-
SHA256
58fdd32be6dcc694fd1a4deeb0ca7b50affa5e8e654cc0dcf9c7ec043ab11cf8
-
SHA512
162256723a3297a140a97ceaa1e8b13b8d09ecdf09f2f698f084b155717202b8910ecb723e8dd0e5915addf09d27ef382c12aaea10d8baf9d8b60d91817593e3
Static task
static1
Behavioral task
behavioral1
Sample
58fdd32be6dcc694fd1a4deeb0ca7b50affa5e8e654cc0dcf9c7ec043ab11cf8.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
58fdd32be6dcc694fd1a4deeb0ca7b50affa5e8e654cc0dcf9c7ec043ab11cf8.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-335065374-4263250628-1829373619-1000\RECOVER+xxwue.TXT
http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/EA4473E83AD50B2
http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/EA4473E83AD50B2
http://nn54djhfnrnm4dnjnerfsd.replylaten.at/EA4473E83AD50B2
http://fwgrhsao3aoml7ej.onion/EA4473E83AD50B2
Extracted
C:\$Recycle.Bin\S-1-5-21-2660308776-3705150086-26593515-1000\RECOVER+dyikf.TXT
http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/BAF86971094FF29
http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/BAF86971094FF29
http://nn54djhfnrnm4dnjnerfsd.replylaten.at/BAF86971094FF29
http://fwgrhsao3aoml7ej.onion/BAF86971094FF29
Targets
-
-
Target
58fdd32be6dcc694fd1a4deeb0ca7b50affa5e8e654cc0dcf9c7ec043ab11cf8
-
Size
608KB
-
MD5
588a1b9290a66ba12d1f3494d12f4286
-
SHA1
71f946f8e3728af3d6ab4065adb7698c0a902037
-
SHA256
58fdd32be6dcc694fd1a4deeb0ca7b50affa5e8e654cc0dcf9c7ec043ab11cf8
-
SHA512
162256723a3297a140a97ceaa1e8b13b8d09ecdf09f2f698f084b155717202b8910ecb723e8dd0e5915addf09d27ef382c12aaea10d8baf9d8b60d91817593e3
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-