Overview

overview

8

Static

static

GOLAYA-DEVOCHKA.exe

windows7-x64

8

GOLAYA-DEVOCHKA.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    f9030589b549283d31ae7cbc178af91e5376712a79acf3df3976b87ce63c2958

  • Size

    86KB

  • Sample

    221202-wbsc5sde6w

  • MD5

    896a1cebdad884d372b6c00d45c1c1b0

  • SHA1

    3a2969fd23da04c3dd36b31bf4c5e91863919fe8

  • SHA256

    f9030589b549283d31ae7cbc178af91e5376712a79acf3df3976b87ce63c2958

  • SHA512

    f7374c6662e6b66b540862a2b26f5c6b7695dbe7c4339e8f2cc59c6ab2d92192bee12ed42b3f1493210a478bc13ac8cc3ae42762c1f6fe86644cbe42735264c9

  • SSDEEP

    1536:jlfbwimgTY23tG90wIsWfHlWKSd+QSqWU5FdCmCWuKw6kS+AJtBcg9HGULnQxYyC:jl0img13tG90HdQ3SqtRjCT7fmJtBfQE

Score
8/10

Malware Config

Targets

    • Target

      GOLAYA-DEVOCHKA.exe

    • Size

      181KB

    • MD5

      3f0da76b4c682e86aeb9a8a425eaa903

    • SHA1

      650b36332381beac233426a3fb4bfeaca92a1296

    • SHA256

      ffa647bd5ec34f2f982bd2695abf1be734d323b66617c9e7f8bdaed49832ec6e

    • SHA512

      29010590d712e329c322430340c3cd28c88d7242fefebe0f404c04f7eb703351b27c5faf01771259bb768c1ed7d14cf1730f626a372754d6579b91656bdc4c92

    • SSDEEP

      3072:YBAp5XhKpN4eOyVTGfhEClj8jTk+0hD+iG+v5y1rF0t8:PbXE9OiTGfhEClq9iktFb

    Score
    8/10

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks