General
-
Target
a9902d7bdf0624e1ff06148f72152231297961eb67bc8e74b4561d39834dd405
-
Size
315KB
-
Sample
220731-hwc73adgd5
-
MD5
ba8869744b32796d25afeb3c0647c3a7
-
SHA1
f9c34582937abffc2d06b05a1446a5c37662a23a
-
SHA256
a9902d7bdf0624e1ff06148f72152231297961eb67bc8e74b4561d39834dd405
-
SHA512
758f82f4262ef7095656040fae62eb1df7f3c66399a03b009d7f29f68677a2d6f481f2d2e047b1b0d9155b416dc4099eb10652d75fa9d753cc626739ad330981
Static task
static1
Behavioral task
behavioral1
Sample
a9902d7bdf0624e1ff06148f72152231297961eb67bc8e74b4561d39834dd405.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
a9902d7bdf0624e1ff06148f72152231297961eb67bc8e74b4561d39834dd405.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
a9902d7bdf0624e1ff06148f72152231297961eb67bc8e74b4561d39834dd405
-
Size
315KB
-
MD5
ba8869744b32796d25afeb3c0647c3a7
-
SHA1
f9c34582937abffc2d06b05a1446a5c37662a23a
-
SHA256
a9902d7bdf0624e1ff06148f72152231297961eb67bc8e74b4561d39834dd405
-
SHA512
758f82f4262ef7095656040fae62eb1df7f3c66399a03b009d7f29f68677a2d6f481f2d2e047b1b0d9155b416dc4099eb10652d75fa9d753cc626739ad330981
Score10/10-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-