Overview

overview

10

Static

static

4f91dbb8d2...20.exe

windows7-x64

10

4f91dbb8d2...20.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20

  • Size

    208KB

  • Sample

    221203-x6cfvahc24

  • MD5

    08038ca0710722b36ff7eabe5cf20530

  • SHA1

    0adf74409cc1a76d0edd73378d679e6c000e688c

  • SHA256

    4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20

  • SHA512

    417fdcdee2a00d3e66715a55acc7cdaf374444075505be000b14311ac8f964649d7c3702912824fd48d463c81c34904ac90fab6ee42a54cb677e6d9f53947a06

  • SSDEEP

    3072:AMPD2WwtpSeUteWvlBLswASQMy6nlNCX4iv:AztpFCLsuh+

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20

    • Size

      208KB

    • MD5

      08038ca0710722b36ff7eabe5cf20530

    • SHA1

      0adf74409cc1a76d0edd73378d679e6c000e688c

    • SHA256

      4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20

    • SHA512

      417fdcdee2a00d3e66715a55acc7cdaf374444075505be000b14311ac8f964649d7c3702912824fd48d463c81c34904ac90fab6ee42a54cb677e6d9f53947a06

    • SSDEEP

      3072:AMPD2WwtpSeUteWvlBLswASQMy6nlNCX4iv:AztpFCLsuh+

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks