Overview

overview

10

Static

static

d28da2298a...1e.exe

windows7-x64

10

d28da2298a...1e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d28da2298a639cae0dd0d89d6f956007bafffde6c6673e746e4f4ddd8145831e

  • Size

    268KB

  • Sample

    221014-l851dsagak

  • MD5

    5bea65c659b1b56ac4f3c517a6d1cb20

  • SHA1

    4fb0267679f6f458d53c80ce07ae6d8edc95d468

  • SHA256

    d28da2298a639cae0dd0d89d6f956007bafffde6c6673e746e4f4ddd8145831e

  • SHA512

    5a55b6f81fa7b495f17ded1e636916624c6f1dedf5953d8106a91d193c4cb3b6a9f2c2e260564c19f276d5e6ca9907fdba11ed90944ab8c279e35117548a7b25

  • SSDEEP

    3072:DdFGXZb6+m/6+mD6+m26+mM6+mx6+mh6+me6+m96+mg6+mV6+mm6+mt6+m16+mvh:BFGX

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      d28da2298a639cae0dd0d89d6f956007bafffde6c6673e746e4f4ddd8145831e

    • Size

      268KB

    • MD5

      5bea65c659b1b56ac4f3c517a6d1cb20

    • SHA1

      4fb0267679f6f458d53c80ce07ae6d8edc95d468

    • SHA256

      d28da2298a639cae0dd0d89d6f956007bafffde6c6673e746e4f4ddd8145831e

    • SHA512

      5a55b6f81fa7b495f17ded1e636916624c6f1dedf5953d8106a91d193c4cb3b6a9f2c2e260564c19f276d5e6ca9907fdba11ed90944ab8c279e35117548a7b25

    • SSDEEP

      3072:DdFGXZb6+m/6+mD6+m26+mM6+mx6+mh6+me6+m96+mg6+mV6+mm6+mt6+m16+mvh:BFGX

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks