9fa8c0261bc2b332e463c07c741fdf9925260e2b17ccf007816405d264cd578b | Triage

Sharing

General

Target

9fa8c0261bc2b332e463c07c741fdf9925260e2b17ccf007816405d264cd578b
Size

228KB
Sample

221107-t3j5qsgah5
MD5

0db6da162ddfb5b82cd0d2d35fa6bbeb
SHA1

d509cfc21745aea23fb992e6ecc313d18234e8ce
SHA256

9fa8c0261bc2b332e463c07c741fdf9925260e2b17ccf007816405d264cd578b
SHA512

08f828c94aed8a04a5dcad635dad02ab86d3788920ccdc2b7db4e4f3ca5570a19ed052881365483a864a608cf4a856bd1b1056414c83f41538eef74273230203
SSDEEP

6144:lwGDh4jLt4NVcWgyGELwXiS8T+bbhn7aRjS5ZgBbJ:GGWntWyD1LiS8lS5ZI

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  9fa8c0261bc2b332e463c07c741fdf9925260e2b17ccf007816405d264cd578b
- Size
  
  228KB
- MD5
  
  0db6da162ddfb5b82cd0d2d35fa6bbeb
- SHA1
  
  d509cfc21745aea23fb992e6ecc313d18234e8ce
- SHA256
  
  9fa8c0261bc2b332e463c07c741fdf9925260e2b17ccf007816405d264cd578b
- SHA512
  
  08f828c94aed8a04a5dcad635dad02ab86d3788920ccdc2b7db4e4f3ca5570a19ed052881365483a864a608cf4a856bd1b1056414c83f41538eef74273230203
- SSDEEP
  
  6144:lwGDh4jLt4NVcWgyGELwXiS8T+bbhn7aRjS5ZgBbJ:GGWntWyD1LiS8lS5ZI
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence