Extracted

• • Target

    3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293

  • Size

    747KB

  • MD5

    e9a2ea574bb733f7c75fc30e3f7172d3

  • SHA1

    167142406d095748096461e215c56b92b2f28a0b

  • SHA256

    3a2a1fba2bea5600fc52fe76f01962816a5389ad98821fd57589202709e85293

  • SHA512

    e37ab5b6f66c1312bf3e20bbe75f4b97e3a665042172926424198b0df1be3bf601e6ce538678999ab390704d09f4c81f2f4d910430da11a71736b4a6d2f2315f

  • SSDEEP

    12288:sEDCJJDXb8qWvvMyesvleMkWzChpBTfgYvVtcgwSuLnKtTPNr:smQGbvNvjkJPKuMlXer

  Score

  10^/10

  persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2