Overview

overview

8

Static

static

PHOTO-GOLAYA.exe

windows7-x64

8

PHOTO-GOLAYA.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    986922c4d22a4a1b792b9dba7c01b00e2d75ad26d912ff051207f94ef7de84eb

  • Size

    122KB

  • Sample

    221203-1wl43shc85

  • MD5

    b443bedf4c3b4aba1822a19ba2dec7d3

  • SHA1

    186406307855f3f17b54eaa76103aa00d09526d5

  • SHA256

    986922c4d22a4a1b792b9dba7c01b00e2d75ad26d912ff051207f94ef7de84eb

  • SHA512

    b30f7e1f882f9fa681f55200011914c7366775e322aeca13d8e0f4c4bfefb4b545fac6a153185245663081356806b13ad385e2ffd3e10662e127caeb95439971

  • SSDEEP

    3072:OnHXMpxcGxFyhQ0bOqYNnLK6q1b1ibtCLQdSf2E0JU4ZG:qHmGY/o09tgaKQdSqs

Score
8/10
discovery

Malware Config

Targets

    • Target

      PHOTO-GOLAYA.exe

    • Size

      238KB

    • MD5

      2ca498cc00b0c5baec004b731621c97d

    • SHA1

      41d2d779185cd6274ad1fffecabbbec1d781fd42

    • SHA256

      400b70f625095ce4995eb1e8188e319572abd8a67dacc3b1567641c039dbebf0

    • SHA512

      173830127c25ee0bb1296943930eac3a49da174ad18725f293d46922bac224e0200cfa17a6c5226379bac89d1e5980c7549687b023c4bf92c9f45ec6d5e6538c

    • SSDEEP

      3072:VBAp5XhKpN4eOyVTGfhEClj8jTk+0hNq1dgshuk+Cgw5CKHm:wbXE9OiTGfhEClq9UqTaJJUm

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks