Overview

overview

8

Static

static

e61f3ddf43...3a.exe

windows7-x64

8

e61f3ddf43...3a.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    e61f3ddf43835801a6a228e1557030c8787a7d36738aec698857e0d4cb33f73a

  • Size

    190KB

  • Sample

    221203-nze4qagc78

  • MD5

    083fe38b0eaeb721b88d1c4bca496ab6

  • SHA1

    3ea2fc4a2b97475078774d5e236af72ce0e6ce43

  • SHA256

    e61f3ddf43835801a6a228e1557030c8787a7d36738aec698857e0d4cb33f73a

  • SHA512

    167a008069065b62f933857e045159047e3909db04ad9956e6f1a241733bc42c56545cb088cb7c27440ac991bafc2270fa117e4d150e2095fcf03534c4a367ef

  • SSDEEP

    3072:DDKW1LgppLRHMY0TBfJvjcTp5XE3/wV4krN:DDKW1Lgbdl0TBBvjc/92w

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      e61f3ddf43835801a6a228e1557030c8787a7d36738aec698857e0d4cb33f73a

    • Size

      190KB

    • MD5

      083fe38b0eaeb721b88d1c4bca496ab6

    • SHA1

      3ea2fc4a2b97475078774d5e236af72ce0e6ce43

    • SHA256

      e61f3ddf43835801a6a228e1557030c8787a7d36738aec698857e0d4cb33f73a

    • SHA512

      167a008069065b62f933857e045159047e3909db04ad9956e6f1a241733bc42c56545cb088cb7c27440ac991bafc2270fa117e4d150e2095fcf03534c4a367ef

    • SSDEEP

      3072:DDKW1LgppLRHMY0TBfJvjcTp5XE3/wV4krN:DDKW1Lgbdl0TBBvjc/92w

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks