Extracted

• • Target

    c0f4a5e6d524caa9da99f30cbcdb35fc194a56bf5e429ef54c540f8d486f643d

  • Size

    209KB

  • MD5

    4dd15a308dc75e7d6bb1500144f9faef

  • SHA1

    1d7157cf084e77e4e07739c30163ec1d0c3668d6

  • SHA256

    c0f4a5e6d524caa9da99f30cbcdb35fc194a56bf5e429ef54c540f8d486f643d

  • SHA512

    b4e2f5ef3605891f9341b97760171c95a17e2ffb45679bfa1df5a7819695b61d758aefe728e65eb4c5b0d6e2f1155d78c161b071ac8907d11018ce4d8e965805

  • SSDEEP

    3072:XChJgYMm4xf9cU9KQ2BxA59SPMGOotn2t:rYMm4xiWKQ2BiCM7

  Score

  10^/10

  persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2