Overview

overview

8

Static

static

GOLAYA-PHOTO.exe

windows7-x64

8

GOLAYA-PHOTO.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    e8d34107b3f03346dff47604002493545de5f1600469a7f6e9c247063c0d27e5

  • Size

    136KB

  • Sample

    221003-2wxfgsbbd4

  • MD5

    2d255d4329a5de5c221cddbdc3a39840

  • SHA1

    42a825030b5a5eb1817d0d54a93f2436228a920b

  • SHA256

    e8d34107b3f03346dff47604002493545de5f1600469a7f6e9c247063c0d27e5

  • SHA512

    aaf7bb73f9d0388aec683b552633197f0ced54dab43bbc006b03e0f6cc08c9c1ce0143266c5e983a824eb7f4f348966747f7ddb2be41e70aad108b48aa956488

  • SSDEEP

    3072:JO9dMSFBmZAE9zLEDal88AtFZWeV4TfkElX6u727juTa2AYiHu:gbsZ59zLE+l87Z12lX6u461AE

Score
8/10
discovery

Malware Config

Targets

    • Target

      GOLAYA-PHOTO.exe

    • Size

      239KB

    • MD5

      35e34f63ef670bfe60a3c221d567e654

    • SHA1

      88fcc3e6e54f3a3db84246e6764f27dd6936f1ce

    • SHA256

      6278837bb874cec55e1e76a4216e80a969ecb0f3997f95476532c8093fd68416

    • SHA512

      423191b07909d5aedef8bc3cc5584ac70b7278993572d4f7a0600a731101b054a8abdb6aeb52a17c34b37bb3f46fc2d1a53eadea313203d72551eea8a492a766

    • SSDEEP

      6144:EbXE9OiTGfhEClq9P0A6XAM93eblYuaOJJUG:QU9XiuioblYuaQ

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks