General
-
Target
ad84efb1409e1bef60908409168665dd554bbb7a45c3f5fe7782ff03d0df8639
-
Size
339KB
-
Sample
221128-by969aac3t
-
MD5
04a49504445bb4530635e4a6708f7ac5
-
SHA1
facee6d8339630117bf9e87a60d8cc659208a34d
-
SHA256
ad84efb1409e1bef60908409168665dd554bbb7a45c3f5fe7782ff03d0df8639
-
SHA512
bb261805a96d583342395013f15832fd3aaffed299355be8a38a9407ad03e21edb592613b4cc1654fc68817589fe24335077d3a5cc07678753f3c9449d1b36c5
-
SSDEEP
6144:Q2wtqGbXhN6WwBjkrwdMvz7qu8T5B2U0TOOApIJY7e/ASaEbwwUFLq49aW:vGvwBQrKMo10KFC65wwwUFLq49aW
Static task
static1
Behavioral task
behavioral1
Sample
ad84efb1409e1bef60908409168665dd554bbb7a45c3f5fe7782ff03d0df8639.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ad84efb1409e1bef60908409168665dd554bbb7a45c3f5fe7782ff03d0df8639.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\_ReCoVeRy_+wtsed.txt
http://t54ndnku456ngkwsudqer.wallymac.com/537CD241E7F36ADA
http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/537CD241E7F36ADA
http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/537CD241E7F36ADA
http://xlowfznrg4wf7dli.onion/537CD241E7F36ADA
Extracted
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\_ReCoVeRy_+gnnfr.txt
http://t54ndnku456ngkwsudqer.wallymac.com/AB51DFEB1C5F2C9D
http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/AB51DFEB1C5F2C9D
http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/AB51DFEB1C5F2C9D
http://xlowfznrg4wf7dli.onion/AB51DFEB1C5F2C9D
Targets
-
-
Target
ad84efb1409e1bef60908409168665dd554bbb7a45c3f5fe7782ff03d0df8639
-
Size
339KB
-
MD5
04a49504445bb4530635e4a6708f7ac5
-
SHA1
facee6d8339630117bf9e87a60d8cc659208a34d
-
SHA256
ad84efb1409e1bef60908409168665dd554bbb7a45c3f5fe7782ff03d0df8639
-
SHA512
bb261805a96d583342395013f15832fd3aaffed299355be8a38a9407ad03e21edb592613b4cc1654fc68817589fe24335077d3a5cc07678753f3c9449d1b36c5
-
SSDEEP
6144:Q2wtqGbXhN6WwBjkrwdMvz7qu8T5B2U0TOOApIJY7e/ASaEbwwUFLq49aW:vGvwBQrKMo10KFC65wwwUFLq49aW
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-