Overview

overview

8

Static

static

RUSSKAYA-GOLAYA.exe

windows7-x64

8

RUSSKAYA-GOLAYA.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    fd4c07f9714b623f1e5825d827dfa99b7c3f0eeede027323279ff077594d6337

  • Size

    122KB

  • Sample

    221129-v1x49adb31

  • MD5

    0513b4d7fa2d55cf7c63982f66070c6c

  • SHA1

    7ba8a31c80cbe2f886be9662e8239acbdc48b280

  • SHA256

    fd4c07f9714b623f1e5825d827dfa99b7c3f0eeede027323279ff077594d6337

  • SHA512

    d6a6e7f5915381136f0a8cf05034e01bf348bacc1c528888b69eb7fdeeb2979583917536fcebe0b3230f1724dfeda7362325c95dc90de7f3e64c2bb04ae27408

  • SSDEEP

    3072:ZnHXMpxcGxFyhQ0bOqYNnLK6q1b1ibtCLQdSf2E0JU4ZC:FHmGY/o09tgaKQdSqM

Score
8/10
discovery

Malware Config

Targets

    • Target

      RUSSKAYA-GOLAYA.exe

    • Size

      238KB

    • MD5

      2ca498cc00b0c5baec004b731621c97d

    • SHA1

      41d2d779185cd6274ad1fffecabbbec1d781fd42

    • SHA256

      400b70f625095ce4995eb1e8188e319572abd8a67dacc3b1567641c039dbebf0

    • SHA512

      173830127c25ee0bb1296943930eac3a49da174ad18725f293d46922bac224e0200cfa17a6c5226379bac89d1e5980c7549687b023c4bf92c9f45ec6d5e6538c

    • SSDEEP

      3072:VBAp5XhKpN4eOyVTGfhEClj8jTk+0hNq1dgshuk+Cgw5CKHm:wbXE9OiTGfhEClq9UqTaJJUm

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks