General
-
Target
d05cdcc941de8ed253067a4d0408918ae90263ee52ceadb7bed9b24ed085e2ce
-
Size
162KB
-
Sample
221130-kgq7gsgb7x
-
MD5
5fa7e2104e3586f15c24b76c5943b77e
-
SHA1
92a39bab16bec38a70702cc6142af3448479d870
-
SHA256
d05cdcc941de8ed253067a4d0408918ae90263ee52ceadb7bed9b24ed085e2ce
-
SHA512
161fd1415fc7fd8e996c06484d6c17a2b4125992d49157caf9c312ee0f4f4f140c496b7a92c977262e326975f6dd807734452506eb2cf553e407900910919ebf
-
SSDEEP
1536:Pj0n0WIeUA4w3HqXyP06wttI9tdnnUtxeB9TS41SGK1M7JVJ7Cf5Iqff:hw6XJ6wtWFnUtx89OxG9JPQ5P
Static task
static1
Behavioral task
behavioral1
Sample
d05cdcc941de8ed253067a4d0408918ae90263ee52ceadb7bed9b24ed085e2ce.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d05cdcc941de8ed253067a4d0408918ae90263ee52ceadb7bed9b24ed085e2ce.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
tofsee
91.121.4.118
rgtryhbgddtyh.biz
wertdghbyrukl.ch
Targets
-
-
Target
d05cdcc941de8ed253067a4d0408918ae90263ee52ceadb7bed9b24ed085e2ce
-
Size
162KB
-
MD5
5fa7e2104e3586f15c24b76c5943b77e
-
SHA1
92a39bab16bec38a70702cc6142af3448479d870
-
SHA256
d05cdcc941de8ed253067a4d0408918ae90263ee52ceadb7bed9b24ed085e2ce
-
SHA512
161fd1415fc7fd8e996c06484d6c17a2b4125992d49157caf9c312ee0f4f4f140c496b7a92c977262e326975f6dd807734452506eb2cf553e407900910919ebf
-
SSDEEP
1536:Pj0n0WIeUA4w3HqXyP06wttI9tdnnUtxeB9TS41SGK1M7JVJ7Cf5Iqff:hw6XJ6wtWFnUtx89OxG9JPQ5P
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-