General
-
Target
fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b
-
Size
167KB
-
Sample
221127-qv95eafa61
-
MD5
35b44cd41c7343d92cf067074b7378be
-
SHA1
29d5725e83fdd03bdce9233b743e3a902c8cab8c
-
SHA256
fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b
-
SHA512
444a76e60b53b1e23df65cf71771d7e857027352a29cec5deef316c2373bdb665f3816a0542062e35f245b8164de310045717a18eeba3e4b5a70df9b5d6e94ac
-
SSDEEP
3072:33c1fP4AJJhsdy957BDj3xQ/dMdAL0mSG9G2TFT04/B6X0D6My:HOPjmda57tjBa1L0odTJh/IEdy
Static task
static1
Behavioral task
behavioral1
Sample
fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b
-
Size
167KB
-
MD5
35b44cd41c7343d92cf067074b7378be
-
SHA1
29d5725e83fdd03bdce9233b743e3a902c8cab8c
-
SHA256
fb26a535fff61bcc2d50793540a4d04b87ff1a3ada5f4a38a78ea812536f525b
-
SHA512
444a76e60b53b1e23df65cf71771d7e857027352a29cec5deef316c2373bdb665f3816a0542062e35f245b8164de310045717a18eeba3e4b5a70df9b5d6e94ac
-
SSDEEP
3072:33c1fP4AJJhsdy957BDj3xQ/dMdAL0mSG9G2TFT04/B6X0D6My:HOPjmda57tjBa1L0odTJh/IEdy
Score8/10-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Registers COM server for autorun
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-