General
-
Target
38b4d518dda0abfe2f9443bc4146a295b2d9c9ed521f992c02aa9779e0e6ecb9
-
Size
237KB
-
Sample
221127-tej5tsab43
-
MD5
da4589a4d9f3757d9e9a5ee57b0975f6
-
SHA1
c901fb7d0c9807bbea3550dc3a61918d1bcddaf8
-
SHA256
38b4d518dda0abfe2f9443bc4146a295b2d9c9ed521f992c02aa9779e0e6ecb9
-
SHA512
5e959612aa88d48285d98c11936c5845d33d93412433c349894ff7995c558ed4de103a5467130597efcf3955f931a540e52b72f1609237138f8940fc93d7f083
-
SSDEEP
3072:iQIURTXJtnHOs6CF6veNVEdvFdcflCMX4JzJ9Do4ot6olMfIpKZKFo/hkkt7MY+A:isP6Y6veN4LOPX4lkigoKFArlVnR
Malware Config
Targets
-
-
Target
38b4d518dda0abfe2f9443bc4146a295b2d9c9ed521f992c02aa9779e0e6ecb9
-
Size
237KB
-
MD5
da4589a4d9f3757d9e9a5ee57b0975f6
-
SHA1
c901fb7d0c9807bbea3550dc3a61918d1bcddaf8
-
SHA256
38b4d518dda0abfe2f9443bc4146a295b2d9c9ed521f992c02aa9779e0e6ecb9
-
SHA512
5e959612aa88d48285d98c11936c5845d33d93412433c349894ff7995c558ed4de103a5467130597efcf3955f931a540e52b72f1609237138f8940fc93d7f083
-
SSDEEP
3072:iQIURTXJtnHOs6CF6veNVEdvFdcflCMX4JzJ9Do4ot6olMfIpKZKFo/hkkt7MY+A:isP6Y6veN4LOPX4lkigoKFArlVnR
Score8/10-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Registers COM server for autorun
-
Sets DLL path for service in the registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-