Overview

overview

8

Static

static

PHOTO-GOLAYA.exe

windows7-x64

8

PHOTO-GOLAYA.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    f93c8411720de07a968a314a75a0127c529ab51004f143bef93c02f830be620b

  • Size

    116KB

  • Sample

    221203-gadq2ahe35

  • MD5

    68c5ddd5f815934970ae726915a4ce33

  • SHA1

    80716999f2afe694f1ea79e0b3f536d8616c2d73

  • SHA256

    f93c8411720de07a968a314a75a0127c529ab51004f143bef93c02f830be620b

  • SHA512

    6caff2611f9d193b5b6a0abe77bfdfeeb5091e58fd4a4980d0ca4bdb20e762d1353c18dcf5af0f8d426fb7e00bc78e81327e75c7a4cf82624eb35add9940e48b

  • SSDEEP

    3072:Tl0img13tG90HdQ3Sqt1k4e7iAJjU+hLMDgs2z4kF7fKC:TljpD9Q3Tt1Le7iAVU+ODX2z4vC

Score
8/10
discovery

Malware Config

Targets

    • Target

      PHOTO-GOLAYA.exe

    • Size

      239KB

    • MD5

      9ea5d4e300dd6c096812711fa3c677d2

    • SHA1

      91ae3f2c828d65fc1d862abda77c875a433a09f8

    • SHA256

      fa673f26eca0e92ae23fd52290a15fed2115c3cce647c93a9d52a069d3f82aaa

    • SHA512

      807886572612c5593192318f2ac65fc0d42a77989ac86ccfd730b9544f5fb14fb4aa54aa10bbc7c0f76cde779149da8662d5abba173a503fd942f9669985949e

    • SSDEEP

      3072:7BAp5XhKpN4eOyVTGfhEClj8jTk+0hWmKlv+Cgw5CKHK:mbXE9OiTGfhEClq9PTQJJUK

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks