c6220f201fd426eb4861dfb0c78f577181a23f8641f45c5c9d9f3cb0ea253f8c | Triage

Sharing

General

Target

c6220f201fd426eb4861dfb0c78f577181a23f8641f45c5c9d9f3cb0ea253f8c
Size

124KB
Sample

221106-swxa2shbh9
MD5

08292fb83038bea57d46fb22b2ce0b30
SHA1

f49a10b21268ccacd700f56e7e24f0664275de29
SHA256

c6220f201fd426eb4861dfb0c78f577181a23f8641f45c5c9d9f3cb0ea253f8c
SHA512

fa3684b8939ed7da3f4dffe262ba1b559d5f0b866094b40dad5bece177344e148996c37a79ab31220df97ee8ab9e12387b2e6f30bd748e2180f6c1693e9752ec
SSDEEP

1536:s9szRS5YqYthRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUmE:eGRgYqYthkFoN3Oo1+FvfSW

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  c6220f201fd426eb4861dfb0c78f577181a23f8641f45c5c9d9f3cb0ea253f8c
- Size
  
  124KB
- MD5
  
  08292fb83038bea57d46fb22b2ce0b30
- SHA1
  
  f49a10b21268ccacd700f56e7e24f0664275de29
- SHA256
  
  c6220f201fd426eb4861dfb0c78f577181a23f8641f45c5c9d9f3cb0ea253f8c
- SHA512
  
  fa3684b8939ed7da3f4dffe262ba1b559d5f0b866094b40dad5bece177344e148996c37a79ab31220df97ee8ab9e12387b2e6f30bd748e2180f6c1693e9752ec
- SSDEEP
  
  1536:s9szRS5YqYthRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUmE:eGRgYqYthkFoN3Oo1+FvfSW
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence