cdbc286c4ff0feccecdec4a6b017b67c3ae624a5fb232544ea28f118476cc98f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cdbc286c4ff0feccecdec4a6b017b67c3ae624a5fb232544ea28f118476cc98f
Size

264KB
Sample

221020-mft8vshddj
MD5

a059d671b67bd977e471836de910e61b
SHA1

b08ca9c8f5ea862b724980264a5eb38e3f26ba69
SHA256

cdbc286c4ff0feccecdec4a6b017b67c3ae624a5fb232544ea28f118476cc98f
SHA512

d1eff4967d626c178a23462baf5684e19265dac9f3a46d1ce1cf2af3264fac416e0a859dc52cc2caa1339bcde2d67b4a63c4b5fc8a50c140848a00ffcaf269f0
SSDEEP

3072:fv3KfbTnZ2CX1xZnMIYS3EQqG+vfK5SbwyMtvb0vOkuCE/H/MZpOSKemKmD:UPnk+qG+vfK5Gwy+Yvwfa25D

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  cdbc286c4ff0feccecdec4a6b017b67c3ae624a5fb232544ea28f118476cc98f
- Size
  
  264KB
- MD5
  
  a059d671b67bd977e471836de910e61b
- SHA1
  
  b08ca9c8f5ea862b724980264a5eb38e3f26ba69
- SHA256
  
  cdbc286c4ff0feccecdec4a6b017b67c3ae624a5fb232544ea28f118476cc98f
- SHA512
  
  d1eff4967d626c178a23462baf5684e19265dac9f3a46d1ce1cf2af3264fac416e0a859dc52cc2caa1339bcde2d67b4a63c4b5fc8a50c140848a00ffcaf269f0
- SSDEEP
  
  3072:fv3KfbTnZ2CX1xZnMIYS3EQqG+vfK5SbwyMtvb0vOkuCE/H/MZpOSKemKmD:UPnk+qG+vfK5Gwy+Yvwfa25D
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence