General
-
Target
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334
-
Size
139KB
-
Sample
220730-yrcczaeah8
-
MD5
59716c29133bdaf34175ab183a1a7e3c
-
SHA1
e265094493c86a5a5a2596563cb9c47c592ec599
-
SHA256
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334
-
SHA512
68b05b8a8ca0c40a395de19ed8792c59641155f69e0a9704505a016872de88c5c7f6784f54b0740f0ffb3668bcf85bb263cfc59f7dcdcc50c73444a18976b3eb
Static task
static1
Behavioral task
behavioral1
Sample
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334
-
Size
139KB
-
MD5
59716c29133bdaf34175ab183a1a7e3c
-
SHA1
e265094493c86a5a5a2596563cb9c47c592ec599
-
SHA256
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334
-
SHA512
68b05b8a8ca0c40a395de19ed8792c59641155f69e0a9704505a016872de88c5c7f6784f54b0740f0ffb3668bcf85bb263cfc59f7dcdcc50c73444a18976b3eb
Score10/10-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-