Overview

overview

8

Static

static

58af1a2353...d2.exe

windows7-x64

8

58af1a2353...d2.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    58af1a23536d0bf25ad137b52efb8dd766621015b62a5cbd2f4b6ffe12472cd2

  • Size

    30KB

  • Sample

    221201-3ntv3afh2s

  • MD5

    226a08f6b2f378a387b9a11764660ae3

  • SHA1

    dbeb49ab76d95b153d460b9b4b8fe2f5a9736626

  • SHA256

    58af1a23536d0bf25ad137b52efb8dd766621015b62a5cbd2f4b6ffe12472cd2

  • SHA512

    5991b0ff588042f63bcf8ca2784e383920308c9b79c9ae5d7a50fc668b5e21989bfc6aa85e4ac99ffacd71b02b3f9992f63b243d405d84e94f68168f6f87be82

  • SSDEEP

    768:1MV7Va/m3eCv+d8HXVEu5TWWT7Y/vOa59:CU/u7v+dQEUW08vOa5

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      58af1a23536d0bf25ad137b52efb8dd766621015b62a5cbd2f4b6ffe12472cd2

    • Size

      30KB

    • MD5

      226a08f6b2f378a387b9a11764660ae3

    • SHA1

      dbeb49ab76d95b153d460b9b4b8fe2f5a9736626

    • SHA256

      58af1a23536d0bf25ad137b52efb8dd766621015b62a5cbd2f4b6ffe12472cd2

    • SHA512

      5991b0ff588042f63bcf8ca2784e383920308c9b79c9ae5d7a50fc668b5e21989bfc6aa85e4ac99ffacd71b02b3f9992f63b243d405d84e94f68168f6f87be82

    • SSDEEP

      768:1MV7Va/m3eCv+d8HXVEu5TWWT7Y/vOa59:CU/u7v+dQEUW08vOa5

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks