Overview

overview

8

Static

static

bac8c3a225...a0.exe

windows7-x64

8

bac8c3a225...a0.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bac8c3a225bbbbc6b93c1ca77efbf1cfc5008fbdd69bddec1061e6278f5cfaa0

  • Size

    460KB

  • Sample

    221203-g6lfrabh68

  • MD5

    fa701c98f73d0572c34666f5af43d82f

  • SHA1

    01357c249d9c7657ccf3d65fa6e1e55dd3117623

  • SHA256

    bac8c3a225bbbbc6b93c1ca77efbf1cfc5008fbdd69bddec1061e6278f5cfaa0

  • SHA512

    0654062c74083cfbf108f73f4b390874f943936abf2cdb35322aeb235a412f82acde531520e46224a0637eca7b7c04f12dc72bd7d83ef6262eb5f320133ac05d

  • SSDEEP

    6144:CBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8+YLpIh9jhl:9pQD+mO5KWy/zrVbt4fcY7Y9U9jv

Score
8/10
persistence

Malware Config

Targets

    • Target

      bac8c3a225bbbbc6b93c1ca77efbf1cfc5008fbdd69bddec1061e6278f5cfaa0

    • Size

      460KB

    • MD5

      fa701c98f73d0572c34666f5af43d82f

    • SHA1

      01357c249d9c7657ccf3d65fa6e1e55dd3117623

    • SHA256

      bac8c3a225bbbbc6b93c1ca77efbf1cfc5008fbdd69bddec1061e6278f5cfaa0

    • SHA512

      0654062c74083cfbf108f73f4b390874f943936abf2cdb35322aeb235a412f82acde531520e46224a0637eca7b7c04f12dc72bd7d83ef6262eb5f320133ac05d

    • SSDEEP

      6144:CBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F8+YLpIh9jhl:9pQD+mO5KWy/zrVbt4fcY7Y9U9jv

    Score
    8/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks