General
-
Target
0f6e778618fd182e8f9e707ce88e6dd89c1fd7ab14f4bed56a425eb824d9e9fc
-
Size
326KB
-
Sample
221022-ff89fsaga6
-
MD5
6b07adb7eeea289e1908cb5baf5a5d93
-
SHA1
47d27128426623be81417c109a12e3838c093eb6
-
SHA256
0f6e778618fd182e8f9e707ce88e6dd89c1fd7ab14f4bed56a425eb824d9e9fc
-
SHA512
11b51f8154d5dbd0adf1bf315dbfb916fc75d9accbc32652259fcc73ff5d4d65a3bdf8283303b32fd73b4632f92f593c7c0410db809d713ffe2950ecc43bdc5e
-
SSDEEP
6144:4pFcA0Dw+mGj3UPqLZmk2NVp8+wt83Bn9RibN2aFeyLnHYH3HntapSPRJ8i:4pww+lwqkk2vp3d9Rih2GeyzYH3HntPJ
Static task
static1
Behavioral task
behavioral1
Sample
0f6e778618fd182e8f9e707ce88e6dd89c1fd7ab14f4bed56a425eb824d9e9fc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0f6e778618fd182e8f9e707ce88e6dd89c1fd7ab14f4bed56a425eb824d9e9fc.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\_ReCoVeRy_+ydksd.txt
http://t54ndnku456ngkwsudqer.wallymac.com/220CEA31BB530D3
http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/220CEA31BB530D3
http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/220CEA31BB530D3
http://xlowfznrg4wf7dli.onion/220CEA31BB530D3
Targets
-
-
Target
0f6e778618fd182e8f9e707ce88e6dd89c1fd7ab14f4bed56a425eb824d9e9fc
-
Size
326KB
-
MD5
6b07adb7eeea289e1908cb5baf5a5d93
-
SHA1
47d27128426623be81417c109a12e3838c093eb6
-
SHA256
0f6e778618fd182e8f9e707ce88e6dd89c1fd7ab14f4bed56a425eb824d9e9fc
-
SHA512
11b51f8154d5dbd0adf1bf315dbfb916fc75d9accbc32652259fcc73ff5d4d65a3bdf8283303b32fd73b4632f92f593c7c0410db809d713ffe2950ecc43bdc5e
-
SSDEEP
6144:4pFcA0Dw+mGj3UPqLZmk2NVp8+wt83Bn9RibN2aFeyLnHYH3HntapSPRJ8i:4pww+lwqkk2vp3d9Rih2GeyzYH3HntPJ
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-