Extracted

• • Target

    788c09eec70d9e0e6288ca1e857ee94d242c1e1b207844865b236a0aa3187576

  • Size

    210KB

  • MD5

    65d901d1afeb570d98d4d613bf94e3e0

  • SHA1

    945a141d2b375639857ca6a03d504b541e8c9282

  • SHA256

    788c09eec70d9e0e6288ca1e857ee94d242c1e1b207844865b236a0aa3187576

  • SHA512

    df902e3f4ed0a8e28aa730b9011547dc417d3c0f93c1d039cf43d4760c168ddf1ca4559d62a29bca261c6516dff51e123fa25de6a60c5041618925b77d3240d3

  • SSDEEP

    1536:VNSXbc74YTOnlNSUL09atT0mBBA7aKSvIYFwAfdvoKQO5j:VEo75OnPSI09qgmBBAGKSvwovoK9F

  Score

  10^/10

  persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2