f0ab1eba7b42c056dffc49bb68b91e7c6c7eadaa51f1e67ad1f651061e92f706 | Triage

Sharing

General

Target

f0ab1eba7b42c056dffc49bb68b91e7c6c7eadaa51f1e67ad1f651061e92f706
Size

89KB
Sample

221202-v1hdsscf8s
MD5

804378986b3fe98bfe1c943cb134d964
SHA1

34cb565c68679024be93218b27f71e6ca52e2e30
SHA256

f0ab1eba7b42c056dffc49bb68b91e7c6c7eadaa51f1e67ad1f651061e92f706
SHA512

bbe1aaa4b97845cee5f9969d59c986ad6cced9a7724cafa33a4c3f5627147baceb3a92a76c5a96c1cd4601e3b20e909f938913455f41a7a392417658a5f67688
SSDEEP

1536:kUnVN5HOHUEs6iqcuyIJ4fnb07w3317NbesR3SRXAlO+aSPVTtHvsGiKlv:kUnLYCq/Fufnb07YPe8CJADDNtkRKN

Score

8^/10

Malware Config

Targets

- Target
  
  GOLAYA-SEXY.exe
- Size
  
  180KB
- MD5
  
  956e2b490c56f641e1ec22001a6c8390
- SHA1
  
  4cc154694540b69f848c6508996c964981f1c6dc
- SHA256
  
  4b6a3c6b886086fbe58630f2742813b2fe79bf89b047551ddd9560a5f40839e8
- SHA512
  
  03c3b0e411f5f77f4164e1070884bb60b7a8e7948f142c2ddf574aac6178643522f8ab2ec221e8dd6dd243ff98129e6a9f8446a4dbec92dbe01c7da67c6714d0
- SSDEEP
  
  3072:rBAp5XhKpN4eOyVTGfhEClj8jTk+0hR4udk4RjbC5:WbXE9OiTGfhEClq9Xuvjb4
Score

8^/10
- Blocklisted process makes network request
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2