Overview

overview

8

Static

static

8

message.scr

windows7-x64

8

message.scr

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    499fa5559b80d3f9ea031453bf144fae

  • Size

    179KB

  • Sample

    221011-zldvaadggj

  • MD5

    499fa5559b80d3f9ea031453bf144fae

  • SHA1

    7d7c177b037bf30ea74d3158a92275103f9d4397

  • SHA256

    90001be7ff68bef29e4ed79212b4f39a77d039e5023cff97ec2c05ce1bdb5f48

  • SHA512

    71ad6a6eb195db5c6e22f714f0d9796d1e379b66e60be4f066cabada72bb618a9301363151281db6711f0dc20a905c8de82921af45c917227586359fcbfc2399

  • SSDEEP

    3072:LJNx/F0VGuhBYyIWMOeJhA2yOBGhGKMtIZaXQqrDFmwJibZceHkIox8iZz5uN9:LaBD45JK2yKGhGqZWDFbJiMxTZQN9

Score
8/10
aspackv2persistence

Malware Config

Targets

    • Target

      message.scr

    • Size

      127KB

    • MD5

      d0486bc4d182c72be41602b5b5f1da91

    • SHA1

      16193e1e15b20510216109b6f530682bea256bb8

    • SHA256

      92173b985f9d4c36dd440fbaa42dd2d9633b0dde4ef30a0639fb591503fd50df

    • SHA512

      3498887338971fa83a1ed0d6f4921e288a3d347b93c17b4de2ee1f5d6ac8344a93340cb1268d53fcd0cd43e3dc7bc5e75698a807197608dad2a95433100ae7a4

    • SSDEEP

      3072:LpDBAKMk0gAN4lgOjCFQ2nf6bdtUNhomcN:LfMPgwIyNSb/Yho

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks