Overview

overview

8

Static

static

GOLAYA-PHOTO.exe

windows7-x64

8

GOLAYA-PHOTO.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    18f07899a2e7d4267371ab06a2b7cb7bbb312501db1007d70e664380a76dab27

  • Size

    99KB

  • Sample

    220919-wm3y1sbfa8

  • MD5

    04ce7dda9829d37c03314985c23c05df

  • SHA1

    4fa86202afd483930a6f1a4a4cdf2241690da639

  • SHA256

    18f07899a2e7d4267371ab06a2b7cb7bbb312501db1007d70e664380a76dab27

  • SHA512

    9e87bb28022f133d5ba7ed8499530bb7ed00c327db5caf60a9f135294c9247cae24ee0207c833b9bfdbae8b560d2d4027b8eebabb3597677b639c37318d3571f

  • SSDEEP

    3072:c47excGxFLPkH9SnbZDaFqLxRntGr+2tItZYpz4PIsc:c+eGYtPk0Z+eaHyE54PIz

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-PHOTO.exe

    • Size

      149KB

    • MD5

      0196884e4ae0fc48c9bf5f8260502466

    • SHA1

      40a78aeb8bcd7abd24088e1103ac3b292c30992a

    • SHA256

      20621acdaf45c4cbcdeb972a78a8baca5cb0327489da84523c406a1e740ec7ab

    • SHA512

      cb9a56c4c3415c955befeaedcf83e92fbe768e1bcef07d280f0c5a3f047bbc6f9dc58532c4562088ee44bd8ec69acba371e22f42b92319517bd4d1cb6a66a55f

    • SSDEEP

      3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hiHZYpz4PIsa:AbXE9OiTGfhEClq9k54PId

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks