General
-
Target
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724
-
Size
142KB
-
Sample
220731-mtys7sdedm
-
MD5
e4e980a178180b5aa5f096c10e9f5557
-
SHA1
f55b0a91c0cc81e61d6f23b8695ce4fa917f04d6
-
SHA256
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724
-
SHA512
5f762ee974d14b69deb25266835644a20862f2da14f64bde6885ff27e1250b840d6cf44f3f3b36742b1502692f879382ccc59c8cab08d56b299cd8c71a3f6109
Static task
static1
Behavioral task
behavioral1
Sample
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724
-
Size
142KB
-
MD5
e4e980a178180b5aa5f096c10e9f5557
-
SHA1
f55b0a91c0cc81e61d6f23b8695ce4fa917f04d6
-
SHA256
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724
-
SHA512
5f762ee974d14b69deb25266835644a20862f2da14f64bde6885ff27e1250b840d6cf44f3f3b36742b1502692f879382ccc59c8cab08d56b299cd8c71a3f6109
Score10/10-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-