fb5cfc456eb1da1b1da9f58612c5f23a680ddc9744b1595cdb54a68c23fe514d | Triage

Sharing

General

Target

fb5cfc456eb1da1b1da9f58612c5f23a680ddc9744b1595cdb54a68c23fe514d
Size

272KB
Sample

221202-gzg5radh2x
MD5

5772b969d7ad53843bd09f2c0c5bb700
SHA1

e6af1359bff0455fe868ca9f66e9287cbadd8045
SHA256

fb5cfc456eb1da1b1da9f58612c5f23a680ddc9744b1595cdb54a68c23fe514d
SHA512

6c7e1db257cd4584c26e260ba9a409011ab619737806f01e5fc07b7bef496a71eff9c07665d58defd4390a5f90717a88c938ab8d96016b1246096bb1c9741854
SSDEEP

3072:B4f9gmss0FvbVJznCRcz/hVFA9MSs/PLLj+Qm4U3YwgTeA3yR:+2vbfznH7O9G/PLLxU3YwgT

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  fb5cfc456eb1da1b1da9f58612c5f23a680ddc9744b1595cdb54a68c23fe514d
- Size
  
  272KB
- MD5
  
  5772b969d7ad53843bd09f2c0c5bb700
- SHA1
  
  e6af1359bff0455fe868ca9f66e9287cbadd8045
- SHA256
  
  fb5cfc456eb1da1b1da9f58612c5f23a680ddc9744b1595cdb54a68c23fe514d
- SHA512
  
  6c7e1db257cd4584c26e260ba9a409011ab619737806f01e5fc07b7bef496a71eff9c07665d58defd4390a5f90717a88c938ab8d96016b1246096bb1c9741854
- SSDEEP
  
  3072:B4f9gmss0FvbVJznCRcz/hVFA9MSs/PLLj+Qm4U3YwgTeA3yR:+2vbfznH7O9G/PLLxU3YwgT
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence