c5ad5174a587520da29b57905ab69de01bebc1035831b53b180cf94f69b7892a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c5ad5174a587520da29b57905ab69de01bebc1035831b53b180cf94f69b7892a
Size

152KB
Sample

221011-zj8xmsdgbp
MD5

62842e05bb812b33b73c2d6285ad37a3
SHA1

5f5b27886980099befe55d623b9cc4e42f5d5603
SHA256

c5ad5174a587520da29b57905ab69de01bebc1035831b53b180cf94f69b7892a
SHA512

c192df417268588365cfff34c0a4b4b72201c7b1a8dcc58eabdf3274362053325ba142829bd3b3e5504563bacd7610b0bbfada7d8cdc5415645c0cbb6b5e4079
SSDEEP

3072:Urdsw3bS/8KvAmRPveYlUq/kzPi0gEr+YsBYPAZ1KHiLwcIaZ154oQZiE+m:ALSCEGaUq8iHEXsCJR8ZdW9

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c5ad5174a587520da29b57905ab69de01bebc1035831b53b180cf94f69b7892a
- Size
  
  152KB
- MD5
  
  62842e05bb812b33b73c2d6285ad37a3
- SHA1
  
  5f5b27886980099befe55d623b9cc4e42f5d5603
- SHA256
  
  c5ad5174a587520da29b57905ab69de01bebc1035831b53b180cf94f69b7892a
- SHA512
  
  c192df417268588365cfff34c0a4b4b72201c7b1a8dcc58eabdf3274362053325ba142829bd3b3e5504563bacd7610b0bbfada7d8cdc5415645c0cbb6b5e4079
- SSDEEP
  
  3072:Urdsw3bS/8KvAmRPveYlUq/kzPi0gEr+YsBYPAZ1KHiLwcIaZ154oQZiE+m:ALSCEGaUq8iHEXsCJR8ZdW9
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence