fa0c768eda111a9ab262f943f7e32f98ffb5ff44564602155c4c5345a7566a06 | Triage

Sharing

General

Target

fa0c768eda111a9ab262f943f7e32f98ffb5ff44564602155c4c5345a7566a06
Size

88KB
Sample

221202-gzpvladh4t
MD5

0b39a639ecf268664d7d10c42ae682d3
SHA1

687efdb3ee7a4936e4af81ea75f81f68970a73c7
SHA256

fa0c768eda111a9ab262f943f7e32f98ffb5ff44564602155c4c5345a7566a06
SHA512

506fc67a5c98620643966942bf65f013efeac1c255d88630066ecc0bb62a60a0ed134e3777ae6c65eac458354bc77800752d607f6fd1a78db59ecb5b1d4a0086
SSDEEP

1536:itH58pzNKvLtsUbRuy5Vuuzdm4Y1DArCYbPKqyR9JLx2cygtQiprxrXd48CC:i5Ldm4Y1DArCYbPKqyR9JLx2jsXF

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  fa0c768eda111a9ab262f943f7e32f98ffb5ff44564602155c4c5345a7566a06
- Size
  
  88KB
- MD5
  
  0b39a639ecf268664d7d10c42ae682d3
- SHA1
  
  687efdb3ee7a4936e4af81ea75f81f68970a73c7
- SHA256
  
  fa0c768eda111a9ab262f943f7e32f98ffb5ff44564602155c4c5345a7566a06
- SHA512
  
  506fc67a5c98620643966942bf65f013efeac1c255d88630066ecc0bb62a60a0ed134e3777ae6c65eac458354bc77800752d607f6fd1a78db59ecb5b1d4a0086
- SSDEEP
  
  1536:itH58pzNKvLtsUbRuy5Vuuzdm4Y1DArCYbPKqyR9JLx2cygtQiprxrXd48CC:i5Ldm4Y1DArCYbPKqyR9JLx2jsXF
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence