General
-
Target
0458ba650b2ddd9b46fdf74d55a5652b629e34f48cda246fcf7b71d3161cb5ce
-
Size
256KB
-
Sample
221123-xmkywaad9t
-
MD5
4bbdc27a9dea20735b7baf97a4023a20
-
SHA1
26add347fffef9454a50dfc976c66defc3d5cc9f
-
SHA256
0458ba650b2ddd9b46fdf74d55a5652b629e34f48cda246fcf7b71d3161cb5ce
-
SHA512
f3a90919eb9d7c579bbce424a4ac22c665d4d00a8de8ebe7ccee42a7dc91a9456c296ce41ed1d7db36cef6a579576d6c919780db5982739dc163610fd7b4390e
-
SSDEEP
3072:ZxYW6OYVliTJeYbPIBFaoM4QClOehtOCJTiMGB+zFFDb+Lzvd/fFMl4mn2jYgyj:Zxd6ViMF9ps8TiUed/6KjY7
Static task
static1
Behavioral task
behavioral1
Sample
0458ba650b2ddd9b46fdf74d55a5652b629e34f48cda246fcf7b71d3161cb5ce.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0458ba650b2ddd9b46fdf74d55a5652b629e34f48cda246fcf7b71d3161cb5ce.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
0458ba650b2ddd9b46fdf74d55a5652b629e34f48cda246fcf7b71d3161cb5ce
-
Size
256KB
-
MD5
4bbdc27a9dea20735b7baf97a4023a20
-
SHA1
26add347fffef9454a50dfc976c66defc3d5cc9f
-
SHA256
0458ba650b2ddd9b46fdf74d55a5652b629e34f48cda246fcf7b71d3161cb5ce
-
SHA512
f3a90919eb9d7c579bbce424a4ac22c665d4d00a8de8ebe7ccee42a7dc91a9456c296ce41ed1d7db36cef6a579576d6c919780db5982739dc163610fd7b4390e
-
SSDEEP
3072:ZxYW6OYVliTJeYbPIBFaoM4QClOehtOCJTiMGB+zFFDb+Lzvd/fFMl4mn2jYgyj:Zxd6ViMF9ps8TiUed/6KjY7
Score10/10-
Modifies visiblity of hidden/system files in Explorer
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-