Overview

overview

10

Static

static

c38e3a9459...31.exe

windows7-x64

10

c38e3a9459...31.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c38e3a9459e9b2d7113a34d5a7149dcdcd377cb72d970b697276dc7ce85f7b31

  • Size

    132KB

  • Sample

    221203-yvhddsfb8w

  • MD5

    0ad64be814c4c5f08137e42ceb9520a2

  • SHA1

    85e7681dd32da0a1437a1cf7a55476be6095422d

  • SHA256

    c38e3a9459e9b2d7113a34d5a7149dcdcd377cb72d970b697276dc7ce85f7b31

  • SHA512

    142d132652c5f93802b8d1720275e629d12e49381ad48f75bfb8c9a0f612389b33b131c0a46b4b7e93f483f331ce424732c4c75318ab30120b58fd7c611d7095

  • SSDEEP

    3072:nYhdDUheXM0xuyf8C3SOONEluIrnMia06LERKzGXw9E5j4oQ:nYhdoSpuyf8C3SOONEluIrnYreKzGXBd

Score
10/10
evasionpersistence

Malware Config

Targets

    • Target

      c38e3a9459e9b2d7113a34d5a7149dcdcd377cb72d970b697276dc7ce85f7b31

    • Size

      132KB

    • MD5

      0ad64be814c4c5f08137e42ceb9520a2

    • SHA1

      85e7681dd32da0a1437a1cf7a55476be6095422d

    • SHA256

      c38e3a9459e9b2d7113a34d5a7149dcdcd377cb72d970b697276dc7ce85f7b31

    • SHA512

      142d132652c5f93802b8d1720275e629d12e49381ad48f75bfb8c9a0f612389b33b131c0a46b4b7e93f483f331ce424732c4c75318ab30120b58fd7c611d7095

    • SSDEEP

      3072:nYhdDUheXM0xuyf8C3SOONEluIrnMia06LERKzGXw9E5j4oQ:nYhdoSpuyf8C3SOONEluIrnYreKzGXBd

    Score
    10/10
    evasionpersistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks