General
-
Target
5b115ea109dbf8e544900233d6147a179b4909be5bcf1159abb594ad3e272ce6
-
Size
113KB
-
Sample
220802-bkyw3acgg2
-
MD5
45b3273f12bc83726743d90f4d62e100
-
SHA1
85da9c8630b48fca68849323eb469857fb93829a
-
SHA256
5b115ea109dbf8e544900233d6147a179b4909be5bcf1159abb594ad3e272ce6
-
SHA512
e19aca6b4095b18b8d734b8ee4ad39b6a574689d59726f63db28b20be52a2815091ef0b87c64fdaa37c14c0818e93ed5cfe0f333b646347e9eef1d72c768be4d
Static task
static1
Behavioral task
behavioral1
Sample
5b115ea109dbf8e544900233d6147a179b4909be5bcf1159abb594ad3e272ce6.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5b115ea109dbf8e544900233d6147a179b4909be5bcf1159abb594ad3e272ce6.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Targets
-
-
Target
5b115ea109dbf8e544900233d6147a179b4909be5bcf1159abb594ad3e272ce6
-
Size
113KB
-
MD5
45b3273f12bc83726743d90f4d62e100
-
SHA1
85da9c8630b48fca68849323eb469857fb93829a
-
SHA256
5b115ea109dbf8e544900233d6147a179b4909be5bcf1159abb594ad3e272ce6
-
SHA512
e19aca6b4095b18b8d734b8ee4ad39b6a574689d59726f63db28b20be52a2815091ef0b87c64fdaa37c14c0818e93ed5cfe0f333b646347e9eef1d72c768be4d
Score10/10-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Suspicious use of SetThreadContext
-