Overview

overview

10

Static

static

4948f88c52...f8.exe

windows7-x64

10

4948f88c52...f8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4948f88c5249c92994c017c05d87024831d2d05e29cafdcea9a10dc14d5414f8

  • Size

    80KB

  • Sample

    221011-rl6ajahffk

  • MD5

    25cd9f1dc67addfe0cb7d949d12a7cd0

  • SHA1

    2aa265a307fbc6cddf470e421fdf4efadeaaf57b

  • SHA256

    4948f88c5249c92994c017c05d87024831d2d05e29cafdcea9a10dc14d5414f8

  • SHA512

    9f05a071cb02b875572802176b76e38a2814e0ebac03c823c613970a32256590e1c8afb8ffef0591ecf239fa5eab7ac59f310b7b742cd3bdc8564a7f500a9853

  • SSDEEP

    1536:vi7wLqvKGlTGQxguIxZTAwlpwFJ0T72mocT:6oqvrKxZfUFJ0T72mBT

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      4948f88c5249c92994c017c05d87024831d2d05e29cafdcea9a10dc14d5414f8

    • Size

      80KB

    • MD5

      25cd9f1dc67addfe0cb7d949d12a7cd0

    • SHA1

      2aa265a307fbc6cddf470e421fdf4efadeaaf57b

    • SHA256

      4948f88c5249c92994c017c05d87024831d2d05e29cafdcea9a10dc14d5414f8

    • SHA512

      9f05a071cb02b875572802176b76e38a2814e0ebac03c823c613970a32256590e1c8afb8ffef0591ecf239fa5eab7ac59f310b7b742cd3bdc8564a7f500a9853

    • SSDEEP

      1536:vi7wLqvKGlTGQxguIxZTAwlpwFJ0T72mocT:6oqvrKxZfUFJ0T72mBT

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks