Overview

overview

9

Static

static

fb72ed8c8e...ed.exe

windows7-x64

9

fb72ed8c8e...ed.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb72ed8c8e8a7ae82125371acb176ea5a621773956b841ddceecdb8216a687ed

  • Size

    601KB

  • Sample

    221127-ntewrshe3z

  • MD5

    2ba33c7496510f8150e99eb6d7375921

  • SHA1

    a9ed6d7c2a979f9d2e5efb792b4f0be39d498b4c

  • SHA256

    fb72ed8c8e8a7ae82125371acb176ea5a621773956b841ddceecdb8216a687ed

  • SHA512

    ad6a2aacb8484e71fb8b9da75e1bd3df3ce5255f863e624e1123b0475166dd904f9756a1d19aceb383f88f46e631e783ffa3b8a8e757f0e8f1cb842954919ee3

  • SSDEEP

    12288:xORNsuj7LM2e2Bl4St2AxKeAN+GKnvLof/9WraN0bfs3kZwD+ZAdfw:xsNsmM2lBmSt2A+yTof/YrdfqkZwD4AC

Score
9/10
evasion

Malware Config

Targets

    • Target

      fb72ed8c8e8a7ae82125371acb176ea5a621773956b841ddceecdb8216a687ed

    • Size

      601KB

    • MD5

      2ba33c7496510f8150e99eb6d7375921

    • SHA1

      a9ed6d7c2a979f9d2e5efb792b4f0be39d498b4c

    • SHA256

      fb72ed8c8e8a7ae82125371acb176ea5a621773956b841ddceecdb8216a687ed

    • SHA512

      ad6a2aacb8484e71fb8b9da75e1bd3df3ce5255f863e624e1123b0475166dd904f9756a1d19aceb383f88f46e631e783ffa3b8a8e757f0e8f1cb842954919ee3

    • SSDEEP

      12288:xORNsuj7LM2e2Bl4St2AxKeAN+GKnvLof/9WraN0bfs3kZwD+ZAdfw:xsNsmM2lBmSt2A+yTof/YrdfqkZwD4AC

    Score
    9/10
    evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks