b5446b769eb618d58e9c8544c051933694cbf1ca22ee97462c5e4e75300c6d9b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b5446b769eb618d58e9c8544c051933694cbf1ca22ee97462c5e4e75300c6d9b
Size

88KB
Sample

221203-cbdefaea85
MD5

1e096e43fe7b4213d87d24309a34ebb3
SHA1

df791086f189a645ba72af1218f9f2360665ffc0
SHA256

b5446b769eb618d58e9c8544c051933694cbf1ca22ee97462c5e4e75300c6d9b
SHA512

f893da765adb6d0343fde9d3b556eaa1a2af0bf5bc1561ce503cbaadbd0c61bac9aafc8618eb1b7163e6316c646d3a8cebd099b80ac9b2e523abba8fb2d9d439
SSDEEP

1536:LQwHfvMS0xcGxFyhQkrnb1Mq9WbB7fS+lE+dFNpRD+xIh7N0YNPrEiJolmq:LnHXMpxcGxFyhQ0bOqYxf7v3YKj3JoUq

Score

8^/10

Malware Config

Targets

- Target
  
  GOLAYA-TOPLESS.exe
- Size
  
  180KB
- MD5
  
  f28c1e58c5766a111297588e8ab02361
- SHA1
  
  3d55a55fd6d193d32742fe89bf6041f9182ee447
- SHA256
  
  6e239da433517b0856f91d212baebdf1963d80ba6c546a440da19121580818ca
- SHA512
  
  e09add020c39a8fa5b14f094679daa9d0645f4c0fe39a33194e9c4c3cdadee05986904084387437203387d97be4381c9714e47451aff01e6a7e6fcb5ec9797fd
- SSDEEP
  
  3072:6BAp5XhKpN4eOyVTGfhEClj8jTk+0hL/eSZZvLf6CNsPrXJ8WYQKaLba:JbXE9OiTGfhEClq90GSZZvLCCNsPrXJa
Score

8^/10
- Blocklisted process makes network request
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2