General
-
Target
rage-revenge_70ldAC3y.zip
-
Size
10.6MB
-
Sample
220903-wnb7paahck
-
MD5
ff62f380ec4904f106077e782ba3c935
-
SHA1
753a38d55e780d4644654f9694af90c2a8e17ac4
-
SHA256
7e58b9e9fc246287b8cfb16f66836f88f083b6540e3b1349f0f72706d587067a
-
SHA512
cd299a5460aada5cfd70fb4f41a67eb60ec18b39e3cc8d4c05ed01ba0d95345d07efcc25ebc33e978d68f47f1377e9eb1216a11db227e9570b2c659c4ec3ff77
-
SSDEEP
196608:pKM5aUpAI6rSLKSu9gqUd09yHwP94nE68Fj1VpK+mC5USKiODDNzDcR2f4Ae79a:gWP8eBuCHI9NZV1nmeJOV42wW
Static task
static1
Behavioral task
behavioral1
Sample
rage-revenge_70ldAC3y.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\4832_2018080445\us_tv_and_film.txt
Targets
-
-
Target
rage-revenge_70ldAC3y.exe
-
Size
5.2MB
-
MD5
41608a876a5e6602c56d5e71ed225d39
-
SHA1
62a4d8cd674a05a04cbfd3645cea1b826aea0202
-
SHA256
f30fb53648787c25dc0b656cdcb77c0bcec549de20fe3ed7a71d302ea413ec59
-
SHA512
66d8130a1342d0948325837c88abd75247a33f63d57f2cd89d8de1f990eafd87419fd43a3c4f328be482f3591964b3c4360f8383ebc59e794c172044478dd6dd
-
SSDEEP
98304:4ioEnvCpKzDmYir6sWjz5sXfCA6sKfAzkc0cR3Iqgr/z1QAeDl7JdGS4nU0em2yx:hoAawzDzBz86sKfW0yEiDl734UDoK2Nr
Score10/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-