General
-
Target
908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e
-
Size
1.7MB
-
Sample
221203-wzsc2sdg22
-
MD5
25a597ee4c316f9db24e759d7a2b71e0
-
SHA1
ada3372b3f2b58472ba02410de35d9782679d4f0
-
SHA256
908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e
-
SHA512
bd0991ed891174194c2f5d4b6eaa0473ed59325def4c0e2a05b86f3cd8f48357bce27b67089c5bb5cda31d6fab8072bb55b329e3a10a81ab16045087bc162cee
-
SSDEEP
49152:DUUXu+FQWdQE5/qv9w3imteyIIyDtstDuCOux:DUeu+KW20/qv2ymYDIZp
Static task
static1
Behavioral task
behavioral1
Sample
908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e
-
Size
1.7MB
-
MD5
25a597ee4c316f9db24e759d7a2b71e0
-
SHA1
ada3372b3f2b58472ba02410de35d9782679d4f0
-
SHA256
908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e
-
SHA512
bd0991ed891174194c2f5d4b6eaa0473ed59325def4c0e2a05b86f3cd8f48357bce27b67089c5bb5cda31d6fab8072bb55b329e3a10a81ab16045087bc162cee
-
SSDEEP
49152:DUUXu+FQWdQE5/qv9w3imteyIIyDtstDuCOux:DUeu+KW20/qv2ymYDIZp
Score8/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-