Overview

overview

8

Static

static

PHOTO-DEVOCHKA.exe

windows7-x64

8

PHOTO-DEVOCHKA.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    2702d4841d659b81458b9cbf706cdd1808f361bbb384edd5eb24d25568442d8d

  • Size

    119KB

  • Sample

    220919-bqtvasedbl

  • MD5

    728517d25241203dd1f1ef53a99892fa

  • SHA1

    f7b2714c20f13cc54a8c3199b5acb7ad77f87812

  • SHA256

    2702d4841d659b81458b9cbf706cdd1808f361bbb384edd5eb24d25568442d8d

  • SHA512

    40b280c314c6b15586cca002c2bc1c34b63b3d591ccaa9affe7096e02a7951eb31566d462a23db641483654815a41df42a2068a52ec3acb0ecfbcda7ccaea525

  • SSDEEP

    3072:Yrz/BRg1SR31UMrsj1BzoAGuw0bNtMPHS5Z+aQo:YP/BRg1SR31UMq+v0bzMPHGH

Score
8/10
discovery

Malware Config

Targets

    • Target

      PHOTO-DEVOCHKA.exe

    • Size

      239KB

    • MD5

      22c9f0d7dfadf25b221bee4d6fe9c39f

    • SHA1

      171e6a865624222ae347d828a2a415a243c05951

    • SHA256

      bc604cfca1473eb7ceb590689348f5a840a6e9425319e9ef120a893390345c58

    • SHA512

      352265ba2ced7b5a6c2ee82f4fbf4788bf20a840684e827c548792e814f191da6be20b820bc8eebd77cfd27880904018cdc8ee5a54893e7eedd27e1cd196eee1

    • SSDEEP

      3072:kBAp5XhKpN4eOyVTGfhEClj8jTk+0hM3GRjDNOoCya+Cgw5CKH2:zbXE9OiTGfhEClq9EjQKJJU2

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks