94b2431f847c516d5bddd0bd97c4f8e0e5bd686e5871a7e96e04eee825560f5e | Triage

Submit
Reports

Overview

overview

Static

static

94b2431f84...5e.exe

windows7-x64

94b2431f84...5e.exe

windows10-2004-x64

8

Sharing

General

Target

94b2431f847c516d5bddd0bd97c4f8e0e5bd686e5871a7e96e04eee825560f5e
Size

444KB
Sample

221124-gjygssfg41
MD5

a12af9ac3b88bd802ab10327d5dc4dc0
SHA1

f082334335fc2485931119d196a52a3fad7db232
SHA256

94b2431f847c516d5bddd0bd97c4f8e0e5bd686e5871a7e96e04eee825560f5e
SHA512

583cf73cb40e95f90e1fa52d1548c653757b720eeabb74b07f6344d40e15a8b0f5194bcc4371b1db7b37db6ce8d7311f87b060e4bb052e1bdbd30613ff4955ff
SSDEEP

12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTja:JoC7ijwFKlVadZ3+8qNa

Score

10^/10

evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

94b2431f847c516d5bddd0bd97c4f8e0e5bd686e5871a7e96e04eee825560f5e.exe

Resource

win7-20221111-en

evasion persistence trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

94b2431f847c516d5bddd0bd97c4f8e0e5bd686e5871a7e96e04eee825560f5e.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  94b2431f847c516d5bddd0bd97c4f8e0e5bd686e5871a7e96e04eee825560f5e
- Size
  
  444KB
- MD5
  
  a12af9ac3b88bd802ab10327d5dc4dc0
- SHA1
  
  f082334335fc2485931119d196a52a3fad7db232
- SHA256
  
  94b2431f847c516d5bddd0bd97c4f8e0e5bd686e5871a7e96e04eee825560f5e
- SHA512
  
  583cf73cb40e95f90e1fa52d1548c653757b720eeabb74b07f6344d40e15a8b0f5194bcc4371b1db7b37db6ce8d7311f87b060e4bb052e1bdbd30613ff4955ff
- SSDEEP
  
  12288:JHICZ9iSCnm8B/Hw9pVKGCs64DVdZ3+8qFXTja:JoC7ijwFKlVadZ3+8qNa
Score

10^/10

evasion persistence trojan
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

© 2018-2025

Terms | Privacy