Overview

overview

10

Static

static

b49bd18b3c...6f.exe

windows7-x64

10

b49bd18b3c...6f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b49bd18b3c21b71ba5ae3611e487808c6c52f2c7174d7dc0c08ab3aa8c04fd6f

  • Size

    240KB

  • Sample

    221202-zw8gmsdg62

  • MD5

    44c3137a5b9a77e74b91213a49467030

  • SHA1

    300514ad32289c8704df002a47daaf407a58c648

  • SHA256

    b49bd18b3c21b71ba5ae3611e487808c6c52f2c7174d7dc0c08ab3aa8c04fd6f

  • SHA512

    6194a95fdef857f6f3128092d7284b3b2a827ed02e2fb53a327e2dc45656431209625e8f00d8eabbbb4c759e4c59e77d926b03d441067541509a4dc77f7c1aab

  • SSDEEP

    6144:qoS5UtO7RQjX7XN1kd9JbSDviiopNDa/N08iG/B:H4xNSB

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      b49bd18b3c21b71ba5ae3611e487808c6c52f2c7174d7dc0c08ab3aa8c04fd6f

    • Size

      240KB

    • MD5

      44c3137a5b9a77e74b91213a49467030

    • SHA1

      300514ad32289c8704df002a47daaf407a58c648

    • SHA256

      b49bd18b3c21b71ba5ae3611e487808c6c52f2c7174d7dc0c08ab3aa8c04fd6f

    • SHA512

      6194a95fdef857f6f3128092d7284b3b2a827ed02e2fb53a327e2dc45656431209625e8f00d8eabbbb4c759e4c59e77d926b03d441067541509a4dc77f7c1aab

    • SSDEEP

      6144:qoS5UtO7RQjX7XN1kd9JbSDviiopNDa/N08iG/B:H4xNSB

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks