General
-
Target
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa
-
Size
1.8MB
-
Sample
221125-jn93habh96
-
MD5
043a1c1b7811cb6f4e065cc38344b929
-
SHA1
5d2559f9a3e05b9ab7b8c0c81f8f4371ca522492
-
SHA256
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa
-
SHA512
f11dd788253b2ed6f39a7091f1462013d27d7620a493819dd69ad17eb4a85449654eb524aa09a0b3b1d674d3d5b3acf52badfdb5a109e3b018d818e6d4ee15d1
-
SSDEEP
49152:s0sBb4+y/icDmLVQdYHV3mVwe7LE0RGdXZactRx/9nMMq:i41/icSLv3kXEXXscd/9MMq
Static task
static1
Behavioral task
behavioral1
Sample
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
http://galaint.onlinesecstats.info/?0=166&1=3&2=1&3=65&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=jcygevtfwp&14=1
Targets
-
-
Target
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa
-
Size
1.8MB
-
MD5
043a1c1b7811cb6f4e065cc38344b929
-
SHA1
5d2559f9a3e05b9ab7b8c0c81f8f4371ca522492
-
SHA256
5cd3c6f7a132d26bbdde1c082e1265b5c37b2b4ce7a6f283fc1a12cdce4fdffa
-
SHA512
f11dd788253b2ed6f39a7091f1462013d27d7620a493819dd69ad17eb4a85449654eb524aa09a0b3b1d674d3d5b3acf52badfdb5a109e3b018d818e6d4ee15d1
-
SSDEEP
49152:s0sBb4+y/icDmLVQdYHV3mVwe7LE0RGdXZactRx/9nMMq:i41/icSLv3kXEXXscd/9MMq
Score10/10-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Sets file execution options in registry
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-