Extracted

• • Target

    bc4c31efb50fde76d622fcd0e4c5011d7646c078b533b13cff8a834d53201b0b

  • Size

    204KB

  • MD5

    ca3638213f313009d5c0041c2e6f0cf9

  • SHA1

    650d3fb4782a8a095f7036f2d76ccf25b4faa41d

  • SHA256

    bc4c31efb50fde76d622fcd0e4c5011d7646c078b533b13cff8a834d53201b0b

  • SHA512

    5591bb86ac095b76338475785ab7057a7c41d749646cca33ba33ecfc3140082372b6f9aaa5770bea0b32e5173bf0e89f7b28810fc198b6540586ec5b0397d97c

  • SSDEEP

    1536:PfAiHwgicnislGltILYLU9KD02BBAdKJaPoYkwAsdIolf:PfQgicdlGvILcU9KQ2BBAkJaPxnIolf

  Score

  10^/10

  persistence

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2