Overview

overview

10

Static

static

f70558bf25...ea.exe

windows7-x64

10

f70558bf25...ea.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f70558bf2559ea768ffef8add5f01730e04e7e25db041fb94362fed577b75eea

  • Size

    316KB

  • Sample

    221129-vbf5faag6z

  • MD5

    8651019c1916a0d44f342b69016a3c2d

  • SHA1

    027b7e9f83729d13c92c317dda3883e928d21ee5

  • SHA256

    f70558bf2559ea768ffef8add5f01730e04e7e25db041fb94362fed577b75eea

  • SHA512

    e71a092eb99764a6aba96dc6ff73973e59b99cb9ec8a5e42a8e28eef7d44ff2c8978913833cd844bef227637b2ef4cfeb6a86ad4e485d93d3c77d708a95bc7d4

  • SSDEEP

    3072:VGnYJqaSTgrEHUyKJdeIPwAKhKbL0ZEMfPnEGK455ZbZnGSZBC11+bmOCVq5WiTI:4xUeYDSo79Kzs25DlU

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      f70558bf2559ea768ffef8add5f01730e04e7e25db041fb94362fed577b75eea

    • Size

      316KB

    • MD5

      8651019c1916a0d44f342b69016a3c2d

    • SHA1

      027b7e9f83729d13c92c317dda3883e928d21ee5

    • SHA256

      f70558bf2559ea768ffef8add5f01730e04e7e25db041fb94362fed577b75eea

    • SHA512

      e71a092eb99764a6aba96dc6ff73973e59b99cb9ec8a5e42a8e28eef7d44ff2c8978913833cd844bef227637b2ef4cfeb6a86ad4e485d93d3c77d708a95bc7d4

    • SSDEEP

      3072:VGnYJqaSTgrEHUyKJdeIPwAKhKbL0ZEMfPnEGK455ZbZnGSZBC11+bmOCVq5WiTI:4xUeYDSo79Kzs25DlU

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks