Overview

overview

10

Static

static

cfda63db07...24.exe

windows7-x64

10

cfda63db07...24.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cfda63db073b8c1e424f8c267793b106f2199238f4caf5c093f42361000f9424

  • Size

    156KB

  • Sample

    221003-tzeqvaegh8

  • MD5

    30ed3107a8dae84bf84ffa9f520d0b31

  • SHA1

    63d10f00685ce7cb02c16dd44fc602abd35b1a91

  • SHA256

    cfda63db073b8c1e424f8c267793b106f2199238f4caf5c093f42361000f9424

  • SHA512

    dbfaa530696efb047184b373254548cf17a014c642ceacc0b09ec4a0f554c93c905b6cbe849c179545f0235d6b56d3eb2758049e277e401f835c7bc318518827

  • SSDEEP

    3072:DpJSm+FgyqTRlU3NhCBvu9pjZEwDxdr8Jr9e:9JHrRl+NhwWrjuwDQC

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      cfda63db073b8c1e424f8c267793b106f2199238f4caf5c093f42361000f9424

    • Size

      156KB

    • MD5

      30ed3107a8dae84bf84ffa9f520d0b31

    • SHA1

      63d10f00685ce7cb02c16dd44fc602abd35b1a91

    • SHA256

      cfda63db073b8c1e424f8c267793b106f2199238f4caf5c093f42361000f9424

    • SHA512

      dbfaa530696efb047184b373254548cf17a014c642ceacc0b09ec4a0f554c93c905b6cbe849c179545f0235d6b56d3eb2758049e277e401f835c7bc318518827

    • SSDEEP

      3072:DpJSm+FgyqTRlU3NhCBvu9pjZEwDxdr8Jr9e:9JHrRl+NhwWrjuwDQC

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks