General

  • Target

    5235a792951755dc991fe9129bebf48f155f696d81381bc50fb4874ccf0f4ed1

  • Size

    373KB

  • Sample

    221123-vrftlshg57

  • MD5

    460cadf0e7aa0221f56eb4f5a8cbc315

  • SHA1

    fdd5121c630987995f0c6016edc0eb3c70b63bf5

  • SHA256

    5235a792951755dc991fe9129bebf48f155f696d81381bc50fb4874ccf0f4ed1

  • SHA512

    a177b01f4fa7dad94bb5b4d59d7a375d6de9c9e577f3f8785dafe42a02d211003eea40ed2eeff614c1203f5458b1600eebafa52415dc6ad139564577a547b9da

  • SSDEEP

    6144:Zr+MtoKTXp3+Uv6kUIKQlbtO8RwQFclZ4D2QkTxedhTG9fIm:N7nI4ikwS6uUy

Score
8/10

Malware Config

Targets

    • Target

      5235a792951755dc991fe9129bebf48f155f696d81381bc50fb4874ccf0f4ed1

    • Size

      373KB

    • MD5

      460cadf0e7aa0221f56eb4f5a8cbc315

    • SHA1

      fdd5121c630987995f0c6016edc0eb3c70b63bf5

    • SHA256

      5235a792951755dc991fe9129bebf48f155f696d81381bc50fb4874ccf0f4ed1

    • SHA512

      a177b01f4fa7dad94bb5b4d59d7a375d6de9c9e577f3f8785dafe42a02d211003eea40ed2eeff614c1203f5458b1600eebafa52415dc6ad139564577a547b9da

    • SSDEEP

      6144:Zr+MtoKTXp3+Uv6kUIKQlbtO8RwQFclZ4D2QkTxedhTG9fIm:N7nI4ikwS6uUy

    Score
    8/10
    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks