d883505c2b5c2ed5f121f81ddcf9412ae2471d1346e1f33cb0c2a24ed8033560 | Triage

Submit
Reports

Overview

overview

Static

static

d883505c2b...60.exe

windows7-x64

d883505c2b...60.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

Target

d883505c2b5c2ed5f121f81ddcf9412ae2471d1346e1f33cb0c2a24ed8033560
Size

448KB
Sample

221124-gjlg8sfg3v
MD5

8187817716de24e79db47c148ee93c86
SHA1

60657e51d6102fe26806b45e41244214d5271a4f
SHA256

d883505c2b5c2ed5f121f81ddcf9412ae2471d1346e1f33cb0c2a24ed8033560
SHA512

7e988e87463a24549e9812b7a9922330079710589865ff3b43c41a4e87372cca3aefbc603ae12a9a8c67f6e2935148494470fc76555aa65ceae20fa134f8cd3d
SSDEEP

12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTju:JoC7ijwFKlVadZ3+8qNu

Score

10^/10

evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

d883505c2b5c2ed5f121f81ddcf9412ae2471d1346e1f33cb0c2a24ed8033560.exe

Resource

win7-20220812-en

evasion persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

d883505c2b5c2ed5f121f81ddcf9412ae2471d1346e1f33cb0c2a24ed8033560.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  d883505c2b5c2ed5f121f81ddcf9412ae2471d1346e1f33cb0c2a24ed8033560
- Size
  
  448KB
- MD5
  
  8187817716de24e79db47c148ee93c86
- SHA1
  
  60657e51d6102fe26806b45e41244214d5271a4f
- SHA256
  
  d883505c2b5c2ed5f121f81ddcf9412ae2471d1346e1f33cb0c2a24ed8033560
- SHA512
  
  7e988e87463a24549e9812b7a9922330079710589865ff3b43c41a4e87372cca3aefbc603ae12a9a8c67f6e2935148494470fc76555aa65ceae20fa134f8cd3d
- SSDEEP
  
  12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTju:JoC7ijwFKlVadZ3+8qNu
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

© 2018-2025

Terms | Privacy