9529a539d956fb26dabbc3ead1df9e6bb8b0f9aba95ef571520cdc35055bc8a8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9529a539d956fb26dabbc3ead1df9e6bb8b0f9aba95ef571520cdc35055bc8a8
Size

484KB
Sample

221106-l66h5sfaa9
MD5

30140163fad366c993cff56835010d5e
SHA1

c468ae8cfd4a8d9e6ee4aab1ad9c799b82a66f74
SHA256

9529a539d956fb26dabbc3ead1df9e6bb8b0f9aba95ef571520cdc35055bc8a8
SHA512

c9d8e146b8c1efdc10b2bb9daa4e357145c09a4b509e503f906e3eaca3ac1db5e9e2db08238b3b5b133ab2ef1c332dcc8be02c3d1e6c04cbabaca8114fd0b0a4
SSDEEP

12288:BXqdijYkKrHgmlgXkknUnk3nnU+oxziSYQ6:9BQAaEkknUnk3nnU+

Score

8^/10

evasion

Malware Config

Targets

- Target
  
  9529a539d956fb26dabbc3ead1df9e6bb8b0f9aba95ef571520cdc35055bc8a8
- Size
  
  484KB
- MD5
  
  30140163fad366c993cff56835010d5e
- SHA1
  
  c468ae8cfd4a8d9e6ee4aab1ad9c799b82a66f74
- SHA256
  
  9529a539d956fb26dabbc3ead1df9e6bb8b0f9aba95ef571520cdc35055bc8a8
- SHA512
  
  c9d8e146b8c1efdc10b2bb9daa4e357145c09a4b509e503f906e3eaca3ac1db5e9e2db08238b3b5b133ab2ef1c332dcc8be02c3d1e6c04cbabaca8114fd0b0a4
- SSDEEP
  
  12288:BXqdijYkKrHgmlgXkknUnk3nnU+oxziSYQ6:9BQAaEkknUnk3nnU+
Score

8^/10

evasion
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2