fc08850bf8f665229185af91db6b836e04754ac43b66716268503870f1e9bd6b | Triage

Sharing

General

Target

fc08850bf8f665229185af91db6b836e04754ac43b66716268503870f1e9bd6b
Size

140KB
Sample

221002-sz2pyacga3
MD5

7a8f1bfac118b61c8c82f46092e932fa
SHA1

587533647ea62f9d57634be5b5bd8f2c77d2420d
SHA256

fc08850bf8f665229185af91db6b836e04754ac43b66716268503870f1e9bd6b
SHA512

452ae25e8b5271719d18a58f964b74126f21f35ac1c1f7263792952c38094c791933c3c36464a5968ab55ff5115c65e4bd96459ce1ef4c2027b00a4c472ea012
SSDEEP

3072:Pl2rgl1JmkD73mQtFDPB1P85XvbM7h8bdaqmRIxqeHHNMxiz2:Psr61J/72QtFDPB1P85Xvw7h8boqfqeU

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  fc08850bf8f665229185af91db6b836e04754ac43b66716268503870f1e9bd6b
- Size
  
  140KB
- MD5
  
  7a8f1bfac118b61c8c82f46092e932fa
- SHA1
  
  587533647ea62f9d57634be5b5bd8f2c77d2420d
- SHA256
  
  fc08850bf8f665229185af91db6b836e04754ac43b66716268503870f1e9bd6b
- SHA512
  
  452ae25e8b5271719d18a58f964b74126f21f35ac1c1f7263792952c38094c791933c3c36464a5968ab55ff5115c65e4bd96459ce1ef4c2027b00a4c472ea012
- SSDEEP
  
  3072:Pl2rgl1JmkD73mQtFDPB1P85XvbM7h8bdaqmRIxqeHHNMxiz2:Psr61J/72QtFDPB1P85Xvw7h8boqfqeU
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence