Overview

overview

8

Static

static

GOLAYA-PHOTO.exe

windows7-x64

8

GOLAYA-PHOTO.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    246c429bc804c55381d8d402049af2d4dbc3e3efc2eff92a4c674a07a499f945

  • Size

    124KB

  • Sample

    220919-vh6cxahed9

  • MD5

    79ab37bbe2509f905cba19e9aa871bb3

  • SHA1

    08380c8acf469fc35107781cce28d7f24ad320aa

  • SHA256

    246c429bc804c55381d8d402049af2d4dbc3e3efc2eff92a4c674a07a499f945

  • SHA512

    ec04551192d2f32575fd59d59eca21ad53eb38d0590ccb65f7ffaedbb42d7410ec69f6c7f5b453025519b1f21c712111f1fad8b3c561b89f4b545b456ec86b1d

  • SSDEEP

    3072:/l0img13tG90HdQ3SqtRaAUjfdaBdE3SrmnbmO2M41MmD:/ljpD9Q3TtRq7Unrwy1MmD

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-PHOTO.exe

    • Size

      238KB

    • MD5

      466171c86c39f1266019f1386b78ad45

    • SHA1

      cf50984c43232cffb00e181597be92b5a118c65e

    • SHA256

      af2f6bc331ddbf6401b342e21947f949a92143d7f8dea3e6a1dcefca18bcefb2

    • SHA512

      162f43193b6e387ae9bbe77b099d62ad473f47b7dbfddb8e94fe75b3b7003035dadd9bb2e7069e8009eba74a6206784f54999f29ff5ea5a7463b086382018b4b

    • SSDEEP

      3072:QBAp5XhKpN4eOyVTGfhEClj8jTk+0h5TlWnC+Cgw5CKHG:HbXE9OiTGfhEClq9IlWzJJUG

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks